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Preface 


The following study report is based on a contract Statement of Work (SOW) between Boeing Commercial 
Airplane Group (BCAG) and the Federal Aviation Administration Technical Center (FAATC), for the investi- 
gation of “disbenefits” to a commercial jet aircraft created by the incorporation of a cabin water spray 
(CWS) system. The study required, but was not limited to, investigation of effects resulting from the com- 
manded and uncommanded operation of a CWS system in several scenarios: airborne, takeoff, and landing 
approach without the presence of fire (inadvertent activation), and in the presence of fire while the aircraft 
is on the ground (design case). For the case of inadvertent operation, the contract also required estimates of 
cost associated with returning an aircraft to revenue service following water discharge. 

During the course of the study, several issues which were “out-of-scope” of the original contract, but of 
significant concern to the study team, were identified. Those issues are presented in this preface and 
represent the views of the Boeing Commercial Airplane Group developed over the course of this year-long 
study program. While the regulatory bodies have accomplished a great deal in their research into the 
theoretical workings of cabin water spray systems, it is our view that there exist many practical consider- 
ations which must be addressed before water spray systems, in their current form, could be safely integrat- 
ed into the commercial aircraft environment. 

This report will discuss, in considerable detail, the idea of common cause failure, i.e., an abnormal failure 
mechanism that causes the simultaneous failure of redundant systems intended to provide appropriate 
safety margins in the event of normal system or component failure. Given the impact of water on sensitive 
electronics, and the increasingly sophisticated electronic environment in current commercial aircraft, the 
incorporation of a water spray system introduces a potential common cause failure source. The remedy for 
this is straightforward but costly: components and systems in present day aircraft must be redesigned and/ 
or relocated to eliminate water as a common cause failure source. Various types of protective measures are 
certainly possible. In order to provide adequate protection to critical components and systems, however, 
the cost would be considerable. 

A recent Civil Aviation Authority (CAA) paper, titled “Air safety regulation and its commercial impact” 
(Reference 11), published in the Aeronautical Journal, March, 1991, quoted figures of between £77,000 
($147,500) and £106,000 ($203,000) per aircraft for the installed cost of a cabin water spray system, and 
weight penalties of 650 to 1100 lb. What was not clear was the type of aircraft included in these analyses, 
whether they address new designs or retrofit, and what will be required to “waterprooP critical systems to 
make them invulnerable to common cause failure. Not included in these CAA figures is the cost impact to 
the aircraft operator for both operational and maintenance costs, all of which are ultimately passed on to 
the flying passenger. 

In order to fully understand the impact of installation of a cabin water spray system, Boeing has prepared 
detailed design and cost analyses for the “SAVE” system installed in a new 777 aircraft. We believe the unit 
cost, based on 1992 dollars, to be $1.2 million for design and installation, exclusive of the protection 
required for other, water-sensitive systems. Using this analysis as a baseline, estimates for the other aircraft 
in the Boeing family range from $1.7 million for the 747-400, to $530 thousand for the 737, for new con- 
struction aircraft. These figures do not consider the case of retrofit installations in existing aircraft, which 
would be higher. (Additional detail is available in the Aerospace Industries Association report on “Cabin 
Water Spray Systems for Post Crash Fire Protection”, dated December, 1992). Weight estimates for each of 
the study aircraft incorporating a water spray system have also been prepared, based on the same design 
analysis. Unlike the optimistic CAA figures, these weight estimates range from 766 lb for a 737-300, to an 
extreme penalty of 3612 lb for a 747-400. All of these weight Figures are based upon the SAVE system 
precipitation rate of 0.03-inches per minute for 3-minutes, and the net wetted cabin area of each aircraft. 
Preface Table 1 provides a summary of these Figures. 
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Preface Table 1. System Weight Impact 



737-300 

747-400 

757-200 

767-300 

777 

Water (gal) 

54 

247 

75 

120 

148.3 

Water (lb) 

451 

2062 

626 

1002 

1238 

Estimated system weight 

315 

1550 

470 

750 

930 

Total weight 

766 

3612 

1096 

1752 

2168 


Note: Precipitation rate of 0.03-inches per minute for maximum of 3-minutes 


One gallon « 8.35 lb 


In recognition of this severe weight penalty that the system specified by the SOW imposes on the airplane 
and its operator, recent efforts by the CAA and FAA have concentrated on possible methods of reducing 
system weight. Since the weight of the onboard water is the largest portion of the total system weight, the 
most promising approach is the creation of a “smart” system, by reducing the total time of spray and/or 
spraying only that zone where a heat or fire sensor determines that water is required. Studies conducted by 
the CAA indicate that a reduction in onboard stored water of % might still provide 45-seconds of extra 
protection. This type of reduction would allow weights approximately Vi of those indicated in Preface 
Table 1, but the potential for saving lives with these revised amounts is unclear. Also, a “smart” system 
implies a level of system complexity that the SAVE system did not have, and requires that the design 
incorporate, at significant expense, the very high system reliability required of other safety systems and 
critical electronics. 

Estimates of the costs per potential life saved by a number of safety improvements, both current and 
proposed, were presented for comparison purposes in the aforementioned paper. Using the CAA figures, 
the cost per (UK) life saved by a functional cabin water spray system is ±9 million, or $18 million, for UK 
registered aircraft. When compared to other standards used to judge the value of safety improvements, 
these figures appear to be high. However, as we have outlined, the CAA system weight and complexity 
figures seem to be very optimistic, which would make the true cost per potential life saved significantly 
higher than that $18 million. 

The current regulatory activity to establish Net Safety and Cost Benefit Analyses for justification of a cabin 
water spray system is based on a total of 88 “survivable” accidents between 1966 and 1991. A substantial 
portion of this group of 88 accidents involved 1st and 2nd generation commercial jet transports with 
documented accident rates an order of magnitude higher than those for newer generation aircraft intro- 
duced during the last 10 to 15 years (Preface Figure 1). This is significant in two respects; first, it demon- 
strates the tremendous improvements in accident avoidance and passenger safety achieved by newer 
aircraft types, and second, as the accident rate decreases, the true cost of a cabin water spray system to the 
airlines and the flying public again increases substantially beyond the $18 million per (UK) life saved 
currently estimated. With this in mind, and with many of these early commercial jets either out of service or 
due to be retired before any regulation requiring the incorporation of water spray systems is mandated, it 
would seem appropriate to include only those recently manufactured aircraft, that would be affected by a 
potential rule, in the cost and safety benefit analyses. This would be the only proper course of action to 
determine the true relative worth of cabin water spray systems to both the current and future jet fleets. 
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Preface Figure 1. Hull Loss Accident Rates*. 


Laboratory testing has demonstrated, in selected scenarios, that water spray systems can be effective in 
removing heat, delaying the onset of combustion of interior materials, and scrubbing smoke particulates 
from the air. However, the potential for catastrophic loss caused by inadvertent discharge, and a common 
cause type failure inflight, could more than offset the life saving potential of such systems. In the case of a 
commanded activation, in the presence of fire, the potential for slippery conditions, reduced visibility, loss 
of communication and potential disorientation could also create a negative safety benefit. 

The net safety benefit analysis is ultimately the tool which will be used to evaluate the benefits of cabin 
water spray systems versus the disbenefits discussed in this report. We strongly believe that there exists a 
number of issues that must be addressed, either as part of that safety benefit analysis, or in further studies 
which should support the system evaluation programs conducted to date. These include; recent improve- 
ments in heat release and fire blocking materials which have already contributed to an increase in the time 
available for emergency evacuation; the impact of water on sensitive electronics, and how that impact 
might be minimized to assure required levels of system reliability after an inadvertent discharge; the psy- 
chological effect of water on passengers, without a fire threat; an activation sequence that is sensible and 
reliable without increasing pilot workload during critical segments of the flight; and the operational and 
logistical aspects of such systems, such as the need for freeze protection, any water quality requirements, 
and procedures for system test without wetting the interior of a serviceable aircraft. Only by addressing 
these items, and more which are certain to appear, will the true net benefits of cabin water spray systems 
become clear. 
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The outstanding, and improving, safety record achieved by the commercial jet aircraft industry over the past 
35 years is a direct result of the significant strides made in aircraft and equipment design promoted by the 
regulatory bodies, aircraft manufacturers, and the airlines. It further indicates, in our view, that it is far more 
cost effective to spend limited research money on systems and procedures which keep accidents from 
happening, enhancing the safety of the flying public and the health of the industry in the process. 
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Executive Summary 


A “proof of concept” on-board cabin water spray system has been developed that has demonstrated the 
ability to suppress aircraft cabin fires. The motivation for this development was the 1985 British Airtours, 
Manchester accident. This accident resulted in the loss of 55 lives following an uncontained engine failure 
that punctured a wing fuel tank while the aircraft was on its takeoff roll. 

The successful demonstration prompted the Civil Aviation Authority (CAA) to conduct further testing 
that was documented in CAA paper 88014 “Aircraft cabin fire suppression by means of an interior water 
spray system.” Subsequent full-scale fire tests conducted by the Federal Aviation Administration Technical 
Center (FAATC) and various CAA facilities at Teeside and Cardington have demonstrated that a cabin water 
spray mist system is effective in preventing the early onset of combustion of cabin interior materials, and 
removing heat and smoke particulates from the passenger cabin in fire test scenarios. 

In order to obtain a balanced opinion on the benefits of cabin water spray systems (CWSS), the National 
Aeronautics and Space Administration (NASA) and the Federal Aviation Administration requested Boeing 
Commercial Airplane Group (BCAG) to investigate the potential disadvantages or “disbenefits” of CWSS and 
its effect on the aircraft. This study is part of a cost sharing contract agreement between BCAG, FAATC, 
Atlantic City, New Jersey, and NASA-Langley Research Center, Hampton, Virginia to investigate the “disben- 
efits” of installing a “SAVE” Ltd. cabin water spray system in current in-service and new design Boeing 
commercial jet aircraft. 

The primary objective of the Boeing study was to investigate the implications of the activation (commanded 
and uncommanded) of a CWSS on various models of Boeing aircraft, and to identify and quantify the 
potential “disbenefits” that might exist under various operating conditions. All key aircraft functional areas 
have been reviewed for potential damage and consequences. Significant concerns regarding overall aircraft 
safety and the basic economics of cabin water spray (CWS) systems have been identified and discussed 
within the body of this report. The cost of returning an aircraft to service following an inadvertent discharge 
was investigated with assistance from Delta Air Lines. 

Summarizing our key conclusions from this study: 

• CWS is a safety system that can negatively affect other key safety of flight systems, by creating a 
common cause failure source; 

• Flight and evacuation critical systems will require detail review and potential major redesign to 
mitigate water damage; 

• CWS may increase evacuation time; 

• Evacuation into and prolonged exposure to a cold climate following discharge may 
be hazardous; 

• All aircraft systems susceptible to water damage require detail review to minimize damage and 
return to service costs; 

• The cost of returning an aircraft to revenue service following discharge is high; 

• Passenger reactions to activation of water spray are unknown. 
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All key aircraft functional areas have been reviewed and appropriate recommendations presented for 
further study. The overall system reliability will require further assessment with the introduction of water as 
a possible failure mechanism on redundant systems. A net safety benefit analysis should mclude the 
potential effects of slowing passenger egress during evacuation. 
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INTRODUCTION 


The potential for improved survivability of a serious aircraft accident involving fire may be realized by the 
incorporation of a proposed cabin water spray safety system that has been tested by regulatory agencies in the 
United States (US) and the United Kingdom (UK). A prototype aircraft cabin water spray has demonstrated the 
ability to suppress fire in the passenger cabin which can result from a post-incident fuel-fed fire spreading 
rapidly to interior furnishings. The promising results of early testing have been published by the Civil Aviation 
Authority (CAA) (Reference 1), resulting in the pursuit of joint research programs by the CAA and the Federal 
Aviation Administration (FAA). A second, more thorough round of testing has now been completed by those 
agencies, and has confirmed the positive aspects of such a system. 

In order to obtain a balanced opinion of the advantages versus disbenefits (disadvantages) of an onboard 
water spray system, the National Aeronautics and Space Administration (NASA) and the FAA requested the 
Boeing Commercial Airplane Group (BCAG) to investigate the potential disbenefits of this type of system, from 
the perspective of the aircraft manufacturer and the operator. The effects on a modem commercial jet aircraft 
that might result from a water spray discharge have been evaluated for the following cases: the case of inad- 
vertent operation in taxi, takeoff, cruise, and landing modes, and the case of intentional operation while the 
aircraft is on the ground, including possible effects on passenger evacuation. The difficulties and costs associat- 
ed with returning an aircraft to service following discharge, without the presence of fire, have been addressed 

2. BACKGROUND 

The concept of utilizing a cabin water spray system (CWSS) as a means of increasing passenger survivability 
following an accident involving an external fire has its roots in the British Airtours Manchester, UK disaster of 
1985. This accident, resulting in the loss of 55 lives, was caused when fragments from an uncontained engine 
failure pierced a fuel tank while the aircraft was on its takeoff roll. Fuel spilled onto the hot engine, ignited, 
and produced thick black smoke which rapidly entered the passenger cabin through the right rear door, which 
had been opened by a flight attendant before the aircraft stopped Fire subsequently entered the cabin, with 
furnishings becoming rapidly involved, creating an environment of thick smoke, toxic gases, and intense heat. 

This accident was witnessed by the late Jim Steel, founder of SAVE Ltd., who theorized that an onboard water 
spray system, similar to that used in commercial buildings, might have provided enough protection to passen- 
gers to allow extra evacuation time and prevent an accident like this from turning into a disaster. The cabin 
water spray system conceived by SAVE Ltd. was first demonstrated to the CAA in 1987, in a VC-10 fuselage. 

This demonstration was successful enough that a test program was authorized. 

As a result of the initial demonstration of the SAVE Ltd. system, and subsequent testing by the CAA, the airwor- 
thiness authorities in both North America and Europe initiated a collaborative research and development 
program involving aircraft manufacturers and industry. System testing was conducted by the Federal Aviation 
Administration Technical Center (FAATC), located in Atlantic City, New Jersey, and by the CAA at the Fire 
Research Station in Borehamwood, and at its Cranfield and Cardington facilities. The objective of these testing 
programs was to determine scientifically the benefits provided by a cabin water spray system, and how a sys- 
tem might be best configured to provide the maximum benefit. Laboratory testing preceded the full scale 
testing, with efforts concentrating on three effects: atmospheric treatment, where the products of combustion 
are washed from the air; surface cooling, which delays combustion and the production of smoke and toxic gas; 
and cabin cooling, which keeps the temperatures in the cabin to a survivable level. Full scale testing followed, 
with both the CAA and FAA using fuselage sections of production aircraft for a series of fire tests, where jet fuel 
“pan type” fires were lit under controlled conditions. These sections were equipped with production materials 
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and furnishings, and the interiors were instrumented for temperature and gas readings. Initial results from this 
round of testing indicated that water spray inhibits the ability of the furnishings to become involved in the fire 
early in its development, and reduces the cabin temperature to a survivable level. This alone, in the critical 
stages of a fire, provides additional critical minutes for passenger evacuation. As a second benefit, many of the 
products of combustion are washed from the air, and the level of water soluble gases is reduced. 

Following the initial capability demonstrations by SAVE Ltd. and the CAA, several companies in the UK began 
programs aimed at the development of water spray systems and components that could be integrated into, and 
function in, an aircraft environment. These companies have evaluated multiple combinations of nozzle geome- 
try and location to establish system configurations that would maximize the effectiveness of water application 
(quantity and rate), and minimize the amount of water required to be carried on board each type of aircraft. 
Additional tests considered different system types: British Petroleum’s “water curtain” approach, and AIM Avia- 
tion’s modular system, designed to assure maximum survivability in a crash, and provide for easy retrofit of 
existing aircraft. Both Darchem Engineering Ltd. and Walter-Kidde (Fire and Safety International) have concen- 
trated on improvement and optimization of the original SAVE Ltd. system. While each of these approaches 
have their respective advantages, none have been evaluated by an industry or regulatory standard. 

During early 1988, following the initial demonstration of the SAVE Ltd. “proof-of-concept” cabin water spray 
system to the CAA, and its report on BBC Television, BCAG, responding to a request from a major European 
airline customer, initiated a preliminary concept design study of a cabin water spray system for a 737 aircraft. 
After several high level management discussions with this customer, it was determined that the best approach 
to establish a net safety benefit of water spray systems was for BCAG to support the collaborative study effort 
being defined and initiated by the airworthiness authorities in both Europe and North America. This study is 
the result of a cost sharing contract agreement between BCAG, the FAATC, and the NASA-Langley Research 
Center, to investigate the “disbenefits” or disadvantages of installing a SAVE Ltd. type cabin water spray system 
in Boeing built commercial jet aircraft. 

3. SYSTEM OVERVIEW 

As originally conceived, the SAVE system used a two tiered approach to cabin water spray (Figure 3-1). For the 
first tier, a dedicated water supply is carried aboard the aircraft, in tanks located strategically to ensure water is 
available even in the case of aircraft break-up. Pipes run the length of the aircraft (behind trim panels), con- 
necting the water tanks to multiple spray nozzles located in the overhead. In its original configuration, only 
centerline “misting” nozzles were proposed, the water fed to these nozzles being pumped from tanks 
mounted remotely. 


Hoop lines 
(4 pics) 


Fwd sys reservoir 
tank (43 gal) 



Arming & activation switches 
at attendant station 


Figure 3-1. Cabin Water Spray System Isometric. 
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In the second tier, additional rows of nozzles, located outboard at the bin/sidewall interface, were reserved for 
use as a “deluge” system. This portion of the system was intended for use only upon connection of an outside, 
tender carried water supply, whereupon large quantities of water at very high flow rates could be pumped into 
the aircraft quickly. The key to this tender system was a series of external connections in the aircraft’s skin, 
which would accept a nozzle of internationally standardized design, and would accept this high water flow 
upon tender arrival. Thus the onboard water supply would serve to provide several critical minutes of protec- 
tion until the tender could arrive at the scene. 

Following preliminary system definition, it became apparent that, in order to achieve the proper wetted area 
and gain the maximum time advantage for evacuation of a burning aircraft, all nozzles should accommodate 
both flow rates. The tender idea was retained, but all nozzles would be used for the 3-minute misting of the 
cabin for evacuation, followed by tender hook-up and deluge. 

The original “pumping” of water from the onboard tanks was superseded by later concepts which appear more 
promising. These involve either a nitrogen bottle mounted alongside the water tank, pressurized to 3000 psi, 
which would in turn pressurize the water tank when activated, or a pyro-technic device that would pressurize 
the water tank not unlike an automotive air bag. Both systems would include a dump valve that could be 
energized to depressurize the entire system in the event of inadvertent activation. 

All system concepts would utilize flexible piping to connect the overhead piping to the spray nozzle array. All 
piping would be dry in the inactive condition, with light blow-off caps on the spray nozzles to prevent accu- 
mulation of debris and dust which might decrease nozzle efficiency upon system activation. 

Various arming and activation schemes have been suggested, with current tliinking centered around the idea of 
the system being armed by the flight crew, probably as a pre-flight checklist item, and disarmed after climb 
out, to prevent inflight activation. System activation could be initiated in a number of ways. It must be recog- 
nized that the arm/disarm/activation/dump scheme is a significant consideration in the design of a “real” sys- 
tem, such that the possibility of inadvertent activation is “highly improbable”. 

4. SCOPE OF THE STUDY 

The study was designed as a broad, wide-ranging investigation into the potential disadvantages of water spray 
on aircraft systems and emergency evacuation of a wetted aircraft. The investigation considered the implica- 
tions of the activation of a cabin water spray system on various models of its Boeing jetliner aircraft, with the 
757-200 serving as the baseline/focus airplane. 


A 757-200 was “configured” with the “SAVE” cabin water spray system specified in the contract Statement of 
Work (SOW) to assess the impact of installation, and is included for reference in Appendix D. This configura- 
tion was established to estimate approximate sizing criteria and does not consider the installation impact of 
CWS on other aircraft systems, furnishings, interiors, wiring, etc. 

Early in the study, it was decided that the 727 would not be included in the scope. This decision was made for 
two reasons. First, since the 727 is not currently in production, all information regarding its systems and con- 
struction details would have to be pursued through a small, post-production engineering organization. This 
would have made any investigation into water paths, materials, and protective measures much more difficult 
than for current production aircraft. Second, and perhaps more importantly, considering time required for the 
issuance of a Federal Aviation Regulation (FAR), the 727 would likely be nearing the end of its useful life due 
to Phase III noise standards, and might not be included in any regulatory action. A similar reasoning was used 
with the 707, which is also excluded from this study. 
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4.1 


AIRCRAFT 


All current production models were considered in the investigation and include 737, 747, 757 (4-Dooi), 767, 
and 777 where appropriate. Although the SOW called for attention to individual dash numbers (e.g. 737-200, 
etc.), once the study began, it became clear that no particular advantage was to be gained by this approach. As 
will be discussed in greater detail later in this report, a dash number specific approach implies a much finer 
“resolution” of predicted water paths than was found possible. Dimension drawings for each type aircraft con- 
sidered are included in this report as Appendix A. 

4.2 FLIGHT SCENARIOS 

The Statement of Work required the following scenarios be used to facilitate the identification of 
the disbenefits: 


In the ground activation scenario the study aircraft were investigated to establish the disbenefits foi two dis 
tinctly different cases: 

• Case I: (Design Case) is the commanded activation of the CWSS in the presence of a severe fire 

external to the aircraft; 

• Case II: The inadvertent or uncommanded activation of the CWSS while the aircraft is on the 

ground but in a taxi, takeoff, or landing mode. 

In the airborne activation scenario the aircraft systems and controls were investigated to establish those param- 
eters and conditions that would adversely affect safety-of-flight and passenger safety in general. Level flight at 
cruise altitude, takeoff, climb, and landing approach (high flight crew workload) were considered. 

The study also addressed the cost of returning the aircraft to service following the precautionary use or uncom- 
manded activation of the CWSS in the circumstance where the aircraft has not been damaged by fire. Delta Air 
Lines was brought into the study team as a subcontractor to develop the primary cost data for this part of the 
study, and has provided valuable insight in the preparation of this report. Boeing personnel assisted the sub- 
contractor in developing baseline data, and provided consultation as required during the course of this study. 

4.3 BASELINE STUDY REQUIREMENTS 

The cabin water spray system used as the baseline for this study was based on the SAVE Ltd. system developed 
and initially tested in the UK. The system concept specified assumes a unifonn spray distribution pattern over 
the passenger cabin floor area, and a precipitation rate of 0.8 mm (0.03-inches) per minute for a maximum of 
3-minutes. The use of additives, biocides and freeze protection chemicals was not considered part of the study. 

The study concentrated on the spraying of the passenger compartment, including galley areas and above ceil- 
ing panels (Section 4.4). Three areas were specifically identified in the SOW as “non-spray” areas following 
initial technical discussions with the Payloads, Strucmres and Product Development organizations within 
BCAG. These areas are the cargo compartment, underfloor, and cheek areas, and were specifically excluded 
from consideration due to the design of the stnictures, attachment of cargo liners and insulation, and the small 
likelihood that any water spray could be directed into these areas. 
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4.4 


APPROACH AND METHODOLOGY 


The 757-200 (4-Door) model, Figure 4.4-1 and Appendix A, was selected to establish “baseline” disbenefits that 
were to be studied in further detail. All other models would be studied, with only those specific differences to 
the baseline reported. 




Figure 4. 4-1. 757-200 Passenger Configuration . 


During early study team discussions, and in preliminary investigative work, it became apparent that water 
paths, following spray activation, would be extremely difficult to predict reliably. Water paths, it was conclud- 
ed, would be subject to too many variables, including airline specific configuration, environmental control 
system (ECS) status during discharge, absorptive characteristics of cabin materials, passenger count, airplane 
attitude, and even, to a degree, on random probability. This conclusion does not affect that part of the water 
that finds its way to the electrical/electronic (E/E) bay via the E/E cooling system, which is discussed in Sec- 
tion 5.2. This approach acknowledges that water paths and quantities for that portion of the total water sprayed 
in the passenger cabin that leaks through floor panels into the lower areas of the airplane is impossible to 
predict analytically. This fact forced the study into a much more “generic” direction, equipment being studied 
for the presence of water, rather than a specific quantity. It also meant that many equipment items that might in 
reality see no water following the spray event would be reviewed, at least in a broad sense, for any damage 
that water might create. 

Consideration given to spraying above ceiling panels was also approached genetically. This spray requirement 
would prove particularly difficult, as demonstrated by Figures 4.4-2 and 4.4-3* Space above the ceiling panels 
on the standard body airplanes (737, 757) is extremely limited, and it would be very difficult to install the 
piping and nozzles required for cabin water spray. Also, this space limitation would not allow a proper spray 
pattern to develop, and would expose overhead mounted components to direct spray, with little absorbent 
material for protection. As a result, overhead mounted components were also studied for behavior in the pres- 
ence of water, but not a specific amount. The value of spray in these areas should be reviewed. 
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Figure 4.4-2. 757 Overhead (Attic). 



Tourist class 

Figure 4.4-3 . 757 Cross Section. 
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The ingestion of water mist by the ECS was the only portion of this study for which a tally analytical method 
could be used. While assumptions must still be made for this analysis, a specific water quantity that arrives in 
the E/E bay via the blow-tlirough equipment cooling was established analytically. The evaluation of selected 
electronics was made on a worst case basis; that is, all equipment in the bay was considered at risk of damage, 
and the assessment of failure potential evaluated accordingly. Only an extensive test program, with a fully 
equipped airplane, will allow more definitive information for separating areas of greater damage potential from 
lesser ones. 

5. FUNCTIONAL ORGANIZATION EVALUATIONS 

In order to assess the implications of a cabin water spray discharge within the pressurized fuselage, and to 
identify the disbenefits that such a discharge creates, the baseline aircraft (757-200) was evaluated according 
to the responsibilities of the major functional organizations, guided by the affected Air Transport Association 
(ATA) system designators. Representatives from each of the BCAG functional engineering groups (Payloads, 
Environmental Controls, Electrical Systems, etc.) were tasked with evaluating the magnitude of the damage 
or “disbenefits” that might be incurred, and identifying design solutions or approaches that might mitigate 
these disbenefits. 

Product Safety and Reliability Groups (Section 5.9 and 5.10) provided evaluations that considered the relation- 
ships between functional specific systems, and the overall effects of cabin water spray on the safety of the 
airplane and its occupants. 

Study activity was initiated according to the parameters and requirements specified in the SOW. Each of the 
other organizations assessed the expected consequences of the CWSS discharge and conducted their investiga- 
tions as conditions were identified. Summaries of these investigations were collected for Delta Air Lines cost 
analysis and are presented in the following sections. 

5. 1 PAYLOAD SYSTEMS 

The design and integration of cabin water spray systems is under the functional responsibility of Payloads 
Systems. This poition of the study was conducted to quantify the water/mist effects on traditional Payloads 
components for the quantity of water that might be expected to be applied during a system discharge. Consid- 
eration has been given to both commanded and uncommanded events, with the commanded or design event 
considering effects of water on passenger emergency egress only. All items considered in this evaluation apply 
to all models, as specific differences in the Payloads components are subtle, and will generally not affect over- 
all conclusions, except as noted. 

5.1.1 Assumptions 

In order to be assured of a conservative approach, and to satisfy contractual obligations, certain assumptions 
w ere required to be made. 

First, the full duration of waiter spray was required to be 3-minutes. Tliis time corresponds to an International 
Civil Aviation Organization (ICAO) agreement for fire and rescue vehicles to respond to an on field accident. 
For inadvertent or uncommanded operation, consideration was given to artificially limiting the spray duration, 
to 30-seconds or so, as it w r as thought that a manual shutoff could be performed within that time period. Ser- 
vice experience has shown that 30-seconds to be very optimistic, as several past lavatory spills have taken 
considerably longer to effect a shutoff. It has to be further assumed that whatever caused the system to dis- 
charge inadvertently might also prevent its early shutoff. 
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Second, for Payloads, the worst case occurs when the left recirculation fan is off when water is fiist discharged. 
This assures minimal ingestion of water by ECS, thus all water is assumed to be sprayed on cabin furnishings 
and passengers. This amounts to approximately 80 US gallons in a 757, based on the specified precipitation 
rate of 0.03-inches per minute for 3-minutes, water being sprayed in droplets of approximately 80-150 microns 
in diameter. 

Third, “some” quantity of water is assumed to be sprayed directly into the airplanes overhead, above the ceil- 
ing panels. This requirement was specified as part of the system design in the contract SOW. It became 
apparent very early in the study that, for the standard body airplanes, this was not only impractical but physi- 
cally impossible given the limited space above the ceiling panels. Some consideration was given to this case, 
but specific conclusions cannot be drawn as water paths would be very difficult to predict with any degree 
of certainty. 

Fourth, in order to define a manageable problem, wool carpeting was assumed to be installed on the cabin 
floor. The rationale for this comes from Boeing interior standards. Currently, only wool carpets are installed in 
new production aircraft. Tests performed by Darchem Engineering Ltd., Stocton-on-Tees, UK, have shown that 
wool is a very absorbent material (Figure 5.1-1). The absorption of water by synthetics is less clear, however, 
they can be counted on for little or no absorbency’. This makes the impact of CWS in the retrofit market very 
difficult to assess, although several airlines have indicated that they install only wool carpets when refitting 
following overhaul (discussed in detail in Section 5. 1.3.1). 



Figure 5.1-1. Carpet Absorption Characteristics (3-Minute Spray). 


Lastly, the stored water used by the system is assumed to be clean and additive free, with demineralized 
water being preferable. This will in all probability minimize stain damage to furnishings following drying, 
and allow these items to be re-used, but would not prevent freezing or the growth of microorganisms in the 
storage system. 
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5.1.2 


Past Water Event Experience 


A number of water related events were reviewed to provide some degree of information as to what damage 
might be created by water being sprayed over items not designed or intended to be wet. These “events” have 
been reported to Boeing in the fonn of operational service problem reports and, although not usually very 
detailed, are sufficient to provide a flavor of the types of tilings that might be expected during and immediately 
after activation of a water spray system. 

Several cases of leaking lavatories on the 747 upper deck have been reported, with at least one case resulting 
in the discharge of approximately 45 gallons of water (airline estimate) that subsequently soaked carpet and 
ran into the overhead passenger service units (PSUs) on the main deck. Effects from these spills included 
localized loss of lighting and entertainment systems, floor proximity emergency lighting, PSU functions, over- 
heated passenger seat wiring, wet ceiling panels and carpets, and unhappy passengers. No long term data is 
available on these spills, but it is assumed that sufficient reconditioning was performed that will prevent future 
corrosion problems. 

Coirosion problems on airplanes are not new and many service reports deal with this issue. Galley and 
lavatory areas are traditional corrosion problem areas. Even though the amount of liquid spilled there is minor 
compared to what a water spray system would deposit its contribution to corrosion is still significant. Door 
areas which might experience rain water accumulations during airplane servicing or passenger ingress/egress 
are also problem areas, and indicate the type of damage that might be done by water that is left and allowed 
to evaporate. These reports provide strong incentive for prompt refurbishment following water spray discharge. 
Time could be a critical factor in preventing the initial start of corrosion if the water is contaminated. 

Other types of problems that have been reported from water “events” include mold growth on door mounted 
slide rafts, false cargo fire indications (even from excessive humidity), and condensation accumulation that 
drained out of the overhead causing electrical and instrumentation anomalies. Bacterial contamination of the 
water is a serious concern due to the lack of standards and control in various parts of the world. This would 
dictate an aggressive prevention program, requiring frequent system draining and cleaning and, in all likeli- 
hood, some form of biocide in the water. Effects from this type of additive on the clean-up process (staining, 
electrical component corrosion, etc.) following inadvertent discharge is unknown (additional discussion on this 
subject is found in Section 5.7). 

5.1.3 Component Evaluation 

5. 1 .3. 1 Absorption Characteristics 

Following initiation of a water spray event, w r ater will begin to be absorbed by cabin furnishings, seats and 
carpets, and by passenger clothing. A certain amount of shedding is expected from seats and passengers, as 
seats are normally treated (Scotchgard, etc.) to prevent spill damage, and passenger clothing will be entirely 
dependent on season and fabric type (natural or synthetic). The degree of shedding from the seats is also 
variable, dependent on the age of the treatment. In any event, most water will most certainly find its way to the 
floor, and a very absorbent wool carpet. 

A waiter absorption test was performed by Darchem Engineering Ltd., to quantify the amount of water which 
might be absorbed following a 3-minute water spray. Worn wool caipeting used in the test was provided to 
Darchem by British Airways. This carpet was tested in their cabin water spray test chamber (no seats installed), 
equipped with a steel grid floor, and under floor drains and collection points, over which the carpeting was 
installed. The water spray system was set-up to spray at specified application rates, and allowed to am for 
3-minutes. Water was collected over the next eight hours. 
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For the flow rate of 1.05 liter/minute, only 10% of the sprayed water was collected in that time period 
(Figure 5.1-1). Assuming an additional 10% trapped in the collection piping, it is clear that the carpet will 
entrap a very large percentage (up to 80%). For conservatism, a 70% absorption was considered for this study 
(Section 5.2.1). This number is significant, and indicates a high probability that water “flooding” through the 
floor panels into the lower lobe, and towards the front of the cabin onto the flight deck will not occur, al- 
though a certain amount can be expected to be “squeezed out" of the carpet by passenger traffic, ultimately 
dripping through seams in floor panels. While certainly not definitive data, these results do seem to indicate 
that water passing beyond the passenger cabin might be manageable, and should be verified by further testing. 
How water in the caipet might affect an emergency evacuation is discussed in Section 5. 1.3-2. 

5. 1.3.2 Evacuation Consideration 

Significant quantities of water in and on the cabin caipeting might have die effect of slowing down evacuation 
(leather soles on wet wool = no traction), however, no information is available to accurately gauge the effect. 
The evacuation difficulties would be further compounded if the aircraft was not in a level condition, i.e., a 
collapsed landing gear. 

Delay in the evacuation can have an adverse effect on the net safety benefits of CWS. If the fire penetrates the 
cabin, passengers will be exposed to a rapid buildup of toxic gases, smoke and high temperatures. An external 
fire that does not penetrate the cabin can affect evacuation in other ways. The incident involving a Continental 
DC-10 at Los Angeles in March of 1978 is a good example. In this accident, the external fire did not immediate- 
ly threaten occupants, but the radiant heat from die fire rendered the available escape slides unusable before 
the evacuadon was completed. The resulting two fatalities (and another two some months later) would most 
certainly have been greater had die evacuation taken any longer than it did. 

5.1.3 3 Overhead Crown Area Spray Nozzles 

For the case where nozzles are installed above the ceiling panels, the exact water padis would be very difficult 
to predict, as water will flow' over the back side of these ceiling panels. Panels constructed with open, crushed- 
core honeycomb type backs would entrap and hold some water. Sidewall insulation blankets would likely be 
soaked, and water (most likely as large droplets or rivulets) would run into and around PSUs, past fluorescent 
lighting fixtures, reading lights and speakers in the PSUs. As currendy configured, fluorescent fixtures and 
reading lights would likely experience electrical shorting. Halogen type lamps may explode, although these are 
contained and should pose no hazard. NO SMOKING/FASTEN SEAT BELT signs would likely stop working, as 
would the PA system, including the cabin interphone. This would obviously make emergency instructions 
difficult to communicate, and cabin attendant/flight crew communication virtually impossible at a time when 
this is vital. The emergency oxygen system is not considered to be particularly vulnerable, aldrough those 
models with electrically unlatched mask drop doors (on at least all models with chemical oxygen) might be 
compromised. All the items listed here are also somewhat vulnerable from the in-cabin misting, but the direct 
spray above the ceiling would most certainly exacerbate this problem. 

5. 1.3-4 Cabin Lighting 

The failure of electrical equipment in the passenger cabin (discussed in Section 5.3) will have several ramifica- 
tions from a passenger perspective. First, loss of lighting would be very alarming under the best of circum- 
stances, that being the case of inadvertent (no fire hazard) discharge. In an actual fire emergency, it could be 
life threatening. Even a partial lighting loss, combined with at least a partial loss of PA system, could result in 
longer evacuation times than would be required otherwise, and the full benefits of water spray would not be 
realized. In the very best of circumstances, only a few lights might be lost due to redundant circuitry, but there 
would in all likelihood be visible smoke from the shorted units. Service experience has shown that floor prox- 
imity lights (Figure 5.1-2), required for emergency evacuation, would likely not work very long after water 
spray, as galley spills have demonstrated. Emergency lights and exit signs are better protected, but are not 
currently constmcted for exposure to a water-laden atmosphere. 
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Figu re 5 . 1 -2. Emergency Lighting . 


Later model airplanes, especially the wide body type, have electric controls in their armrests, and seat to seat 
wiring bundles for control of reading lights and entertainment systems. There is the danger of a potential shock 
for passengers, and local overheating of electrical cables before circuit breaker trip. This is not considered a 
significant safety hazard, but is one more item warranting additional consideration. Video systems will most 
certainly short if in operation at the time of spray. While these are certainly not essential systems, their damage 
in the inadvertent discharge case would have a substantial impact on the cost of refurbishment. Also, a cathode 
my tube (CRT) type display operating at high voltage is of concern for its potential to produce electrical shock 
to passenger and crew. 

5.1.4 Return to Service 

Commanded discharge of the system is intended for a serious on-ground fire situation. Thus, the issues associ- 
ated with the return of an aircraft to service will only be considered for the inadvertent discharge case. Once 
the aircraft is safely back on the ground, the refurbishment process should begin immediately to prevent the 
start of long tenn problems, such as corrosion. This section of the report addresses Payloads issues, but an 
integrated approach, not unlike a “D” check, must be utilized to mitigate further damage. 

In a refurbishment program, all seats, carpeting, ceiling and sidewall panels, lavatory modules, bins, closets 
and partitions should be removed from the airplane, cleaned, and allowed to dry. Hot air drying of carpets 
should be avoided as that will result in carpets that shrink too much to be re-used. As long as no additives 
have been used in the water, any staining should be temporary and the cleaning process should produce 
components which are technically re-usable. The carpeting panels might also be acceptable, however, airline 
experience may prove otherwise (Section 5.11). Seat cover considerations are similar, but the airline s image 
requirements may dictate that these be replaced as well. The degree of replacement will certainly depend on 
the degree of damage. 
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Ail lights and other electrical equipment which have not failed should be removed, dried, cleaned, and tested. 
The potential for moisture contamination in some of these units dictates a conservative approach. Manufactur- 
ers of this type of equipment have suggested this procedure as being in the best interests of the airline, mini- 
mizing the number of “repeat visits” to remedy a condition that might not have occurred at all. Shorted units 
will need to be replaced at this time as well. In most cases, units that were not on at the time they were wet 
will function properly following reconditioning, while those that were may need to be replaced. Note that, 
while the next generation components of onboard video systems of at least one manufacture! are provided 
with a conformal coating, the current generation are not. This is acceptable since video systems are not a “criti- 
cal” item, but certainly contributes to the cost of refurbishment. 

To prevent structural problems resulting from corrosion, all insulation blankets should be removed from the 
airplane to dry out any moisture trapped behind them. This is especially taie when considering the case of 
additional nozzles being placed in the overhead for spraying water up into the crown area of the airplane. As 
previously discussed, w'ater spray in the overhead could be expected to run past the blankets and be trapped 
by the stringers and frames. 

5.1.5 Mitigation of Disbenefits 

In order to prevent major damage to the interior electrical components such as sidewall lighting and leading 
lights from water spray, certain steps could be taken to “harden” these items to prevent water damage. Many of 
the recommended steps included here will be discussed in detail in the Electrical section of this report. Briefly, 
conformal coatings on all circuit cards, wateiproof connectors, and drip pans in appropriate places will provide 
some degree of additional water resistance to that currently available. A fundamental conflict exists wherein the 
components that are most sensitive to water also require a means to dissipate heat, thus dictating cooling vents 
and ducts. This type of unit cannot be sealed, and alternate “water hardening” and entrapment techniques 
would be required. 

Specific suggestions for assuring continuous operation of certain key Payloads/Electrical units include: 

• Spray above ceiling - eliminate from consideration in small body aircraft due to lack of adequate 
access or spray areas; 

• Fluorescent lights - waterproof connectors and sealed electronic ballasts; 

• Reading lights - waterproof terminals, bulb holders, and sealed housings; 

• PA speakers - drip shields and waterproof connectors or sealed housing; 

• Entertainment systems - conformal coatings, waterproof connectors, interconnect to switch off 
system when water spray is activated. 

5.2 ENVIRONMENTAL CONTROL SYSTEMS 

The ECS, Figure 5.2-1, was reviewed and analyzed to assess the quantity of water mist that might be expected 
to be ingested by the return air grilles in the passenger cabin during activation of water spray. The quantity of 
water ingested is significant, as water laden air is eventually routed to the E/E bay, as part of the cooling foi 
the electronic equipment (Figure 5.2-2). Water that is ingested into the electronics components in the E/E bay 
may create safety-of-flight considerations as a result of the inadvertent discharge (Section 5.3 and 5.9). 
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5.2.1 757 Water Mist Distribution 

Test data and analysis indicate that the ECS will circulate water mist within the passenger cabin as well as 
draw mist from the passenger cabin into the lower lobe. A majority of the moisture is expected to impinge on 
surfaces within the passenger cabin, however,, some will be drawn through the return air grilles and be distrib- 
uted in the lower lobe. Figure 5.2-3 depicts the distribution and associated quantities of water expected to be 
drawn from the passenger cabin and into the lower lobe for the 757 baseline. Water mist will not migrate to the 
flight deck, due to the positive pressure differential that is maintained between flight deck and passenger cabin, 
when the flight deck door is kept closed as required by FAR 121.587. Regulatory agencies that allow or require 
that the door be left open will need to revise regulations accordingly should CWS be required on aircraft. 



* Mist ingestion by electronics is estimated conservatively; 
i.e., mist to external surfaces may be higher than expected 

Figure 5.2-3. 757 Water Mist Paths and Quantities. 
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ECS assessment of mist distribution within the airplane (757-200) was based on the following conditions 
and assumptions: 

• Mist impingement on lower lobe surfaces (structure, cables, wire, etc.) was neglected when quanti- 
fying mist migration to electrical equipment in the E/E bay; 

• Passenger impact on mist distribution was neglected; 

• Average cabin airflow velocity of 75 ft/min (based on test data); 

• Minimum droplet size of 80 microns, and droplets do not coalesce; 

• A mist disbursement rate of 80 gallons over 3-minutes; 

• Airplane configuration was per drawing (i.e., no broken lines); 

• 39,000 foot cruise with two air-conditioning packs and two recirculation fans operating at the time 
of discharge; 

• No mist was actively distributed to flight deck, lavatories, and galleys; 

• Aircraft is carrying revenue passengers, hence flight deck door is closed as required by 
FAR 121.587. 

Typical cabin airflow patterns are shown in Figure 5.2-4. Analysis shows that cabin airflow velocities are high 
enough to overcome the affects of gravity, and thus the potential for drawing mist into the lower lobe via the 
ECS does exist. Based on the geometry' of the cabin, it was estimated that 30% of the mist would be drawn 
through the return air grilles. 



Figure 5.2-4. Typical Passenger Cabin Airflow Patterns. 
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Cabin air, during normal cruise operation, is drawn from the passenger cabin into the lower lobe by the nght- 
hand recirculation fan, left-hand recirculation fan, forward equipment cooling supply fans, lavatory/galley fan, 
and by the pressure differential at the aft outflow valve. Air in the aft portion of the cabin is blown overboard 
through the aft outflow valve. A small amount of air in the aft portion of the passenger cabin is drawn through 
the aft bay electronics (E6 rack) by the lavatory/galley fan prior to discharge over-board via the aft outflow 
valve. Air in the forward section of the passenger cabin is drawn to the lower lobe by the right-hand and 
left-hand recirculation fans, and the forward equipment cooling supply fans. A majority of air drawn by the 
left-hand recirculation fan provides draw through cooling to the electronics prior to being drawn through the 
fan and into the mix bay. Air drawn by the forward equipment cooling supply fans provide cooling to the 
blow-through cooled electronics prior to being recirculated by the left-hand recirculation fan. Air drawn by the 
right-hand recirculation fan is used for cabin ventilation purposes only and is directly drawn from the cabin to 
the mix bay for reconditioning. Figure 5.2-5 depicts the test data airflow distribution for the entire airplane. 
Figure 5.2-6 shows airflow distribution in the E/E bay for equipment cooling. 



Legend: Airflow rates in Ibm/min 
_ — >- Non-ducted flow 

Ducted flow 

— [1 | — Filter and fan 
— - - - Interior divider wall 
PressJunpress 

Figure 5 . 2 - 5 . Aircraft Airflow Distribution. 
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Water mist drawn from the passenger cabin by the forward equipment cooling supply fans will be drawn 
through a centrifugal particle separator prior to reaching the fan. The purpose of this air cleaner is to remove 
solid particulates from the airstream to provide clean air for equipment cooling. A swirling motion is induced 
on the air/ particulate mixture as it passes through the cleaner. Solid particulates are thrown radially outward by 
centrifugal force to the w'alls of the cleaner and are then removed by the purge system. Thus, clean air is deliv- 
eied for equipment cooling and solid particulates are continuously removed. Although the cleaner has been 
tested for solid particulate removal only, the vendor/supplier has determined, but not guaranteed, that water 
droplets will be removed in the same fashion as solid particulates entering the cleaner. For purposes of this 
analysis it has been assumed that the cleaner w r ill perform as expected, however, future testing would be 
required to verify' the cleaner’s performance. Following vendor/supplier recommendation, droplet size was 
reduced by 50% for determining cleaner effectiveness at removing mist. Based on a droplet size of 40 microns, 
it is expected that 96% of the mist entering the cleaner will be removed. 

Should the cleaner not perform as expected, there are other filters that are designed for moisture removal and 
would be adequate for this application. Addition of a mist removal filter may require an upgrade to the current 
fans in order to overcome the increased pressure losses associated with an additional filter. This type of filter is 
susceptible to clogging and would require periodic maintenance to clean. Mist that passes through the air 
cleaner will be evaporated in the air as it passes through the equipment cooling supply fans, where the air- 
stream experiences a 10°F temperature rise. Mist that is captured by the cleaner is expected to puddle in the 
ducting and would require removal as part of the refurbishment process. Puddled water is not expected to be 
drawn into any electronics. 

Mist draw n from the passenger cabin by the left-hand recirculation fan is expected to pass through some of the 
draw through cooled electronics prior to reaching the fan. 

Table 5.2-1 lists airflow' humidity, temperature, and mist rates that are expected to be ingested and/or distribut- 
ed to 757 electronics. Also listed is the mechanism by w'hich mist is delivered to the electronics. 
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Table 5.2-1. Mist Distribution Summaryfor 757 Electronics^ 


Unit No. 

Humidity of 
Ingested Air 
(%) 

Temperature 
of Ingested 
Air (°F) 

Mist Ingestion 
Rate 
(Ibm/min) 

Mechanism 
Causing E/E Mist 
Ingestion 

P33 

100 

75 

0 

LH recirc fan 

P54 

100 

75 

0.231 

LH recirc fan 

P51 

100 

75 

0.1155 

LH recirc fan 

P50 

100 

75 

0.1542 

LH recirc fan 

P37 

100 

75 

0.2246 

LH recirc fan 

P32 

100 

75 

0 

LH recirc fan 

P31 

100 

75 

0 

LH recirc fan 

P34 

100 

75 

0 

LH recirc fan 

P70 

100 

75 

0.2738 

LH recirc fan 

P36 

100 

75 

0 

LH recirc fan 

El 

100 

85 

0 

E/E supply fan 

E2 

100 

85 

0 

E/E supply fan 

E3 

100 

85 

0 

E/E supply fan 

E4 

100 

85 

0 

E/E supply fan 

E5 

100 

85 

0 

E/E supply fan 

P5 

100 

85 

0 


P11 

100 

85 

0 

E/E supply fan 

P8 

100 

85 

0 


P9 

100 

85 

0 


PI-1 

100 

85 

0 

E/E supply fan 

HSI-L 

100 

85 

0 


ADI-L 

100 

85 

0 

E/E supply fan 

PI -3 

100 

85 

0 

E/E supply fan 

P7-L 

100 

85 

0 

E/E supply fan 

EICAS-T 

100 

85 

0 

E/E supply fan 

EiCAS-B 

100 

85 

0 


P7-C 

100 

85 

0 

E/E supply fan 

P7-R 

100 

85 

0 

E/E supply fan 

P3-1 

100 

85 

0 

E/E supply fan 

ADI-R 

100 

85 

0 

E/E supply fan 

HSI-R 

100 

85 

0 

E/E supply fan 

P3-3 

100 

85 

0 


LH glare shield 

Nom cabin 

75 

0 

LH recirc fan 

RH glare sheld 

Nom cabin 

75 

0 

LH recirc fan 

INV 

Nom cabin 

75 

0 

LH recirc fan 

Battery charger 

Nom cabin 

75 

0 

LH recirc fan 

Weather radar 

Nom cabin 

75 

0 

LH recirc fan 

E6 

100 

75 

1.9 

Lav/Galley ex fan 
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Mist drawn from the passenger cabin by the right-hand recirculation fan will reach a filter upstream of the fan. 
This filter is a paper-type filter and is expected to block all mist and thus eventually clog, and may subsequent- 
ly stall the right-hand recirculation fan. This type filter is not reusable and will require replacement. The fan is 
not expected to be damaged as a result of stalling. No impact on electronics cooling is expected, since air 
drawn by this fan is sent directly to the mix bay for cabin ventilation purposes. 

The lavatoiy/galley fan will draw mist from the passenger cabin through the E6 rack near the aft cargo bay. 
The expected quantity of mist ingested by electronics on the E6 rack is shown in Figure 5-2-3. 

Passenger cabin/flight deck air distribution has been designed such that a positive pressure differential be- 
tween the crew cabin and the passenger cabin is maintained (i.e., flight crew cabin is at a higher pressure than 
the passenger cabin) when the flight deck door is kept closed as required by FAR 121.587. This pressure differ- 
ential will prevent airborne mist in the passenger cabin from migrating to the crew cabin. FAR 121.587 applies 
to aircraft carrying passengers only, therefore, aircraft inflight for other purposes could be susceptible to mist 
migation into the crew cabin if the flight deck door is open. 

Mist is expected to condense on all exposed surfaces in the pressurized region of the lower lobe (i.e., struc- 
ture, cabling, insulation blankets, wiring, etc.), except cargo compartment interior surfaces (liners, etc.). 

5.2.2 Proposed Design Changes to Minimize Water Ingestion 

Main electronic equipment bay ingestion of mist can be eliminated by the following actions at the time of 
water spray activation: 

• Left-hand recirculation fan power is shut off; 

• E/E supply fans power is shut off (changes to instrumentation controls may be required); 

• Overboard exhaust valve is closed. 

It should be noted that this action may conflict with current smoke removal procedures and requirements. A 
procedure to incorporate the above actions would require analysis to verify that aircraft smoke removal would 
not be jeopardized, in the unlikely event of accidental inflight activation of water spray with the presence of 
smoke. Appropriate manual overrides to the valve positions may be necessary. 

Aft electronic equipment bay ingestion of mist can be eliminated by the following action at the time of water 
spray activation: 

• Lavatory/galley fan power is shut off. 

Damage to the right-hand recirculation filter can be eliminated by the following action at the time of water 
spray activation: 

• Right-hand recirculation fan power is shut off. 

In the event that mist is ingested by the electronics, continued air flow through the draw tlirough and blow- 
through cooling systems would tend to “dry out” any moisture present, since these systems are capable of 
providing warm air continually. Corrosion potential and reliability concerns w r ould, however, dictate a more 
“active” approach to diying and refurbishment (Section 5.3 and 5.10). 
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5.2.3 


737 Mist Distribution Analysis 


Mist distribution and electronics ingestion of mist within die 737 aircraft is expected to be similar to the 757. 
Blow-through cooled electronics are expected to ingest negligible amounts of mist since the same type of 
cleaner exists on die 737 as on die 757. Quantities of mist expected to be ingested by draw through cooling 
and applied to electronics are shown in Table 5.2-2. 


Table 5.2-2. Mist Distribution Summary for 737-300 Electronics. 


Component 

Number 

Mist Rate 
Gallon/Minute* 

El -P 

0.19 

El-1 

0.05 

El -2 

0.1 

E2-P 

0.19 

E2-1 

0.13 

E2-3 

0.09 

E3-P 

0.18 

E3-1 

0.04 

E3-2 

0.04 

P6-D** 

0 

IP-1** 

0 

IP-2** 

0 

IP-3** 

0 

IP-4** 

0 

IP-5** 

0 

IP-6** 

0 

IP-7** 

0 

IP-8** 

0 

CDU No. 1** 

0 

CDU No. 2** 

0 

IRU No. 1 

0.13 

IRU No. 2 

0.13 


* 3-minute duration 
** Located on the flight deck 









5.2.4 


747/767 Mist Distribution Analysis 


A mist distribution analysis was performed on the 747-400 and the 767-200 airplanes in addition to the 757 mist 
distribution analysis. The analysis focused on the inadvertent discharge of the cabin water spray and its effects 
on the E/E cooling system for these large body aircraft. 

The environmental control system was assumed to be in the normal flow mode with three packs operating. 

The airplane was at a cruise altitude of 35,000 ft. The E/E cooling system was in normal flow mode and the 
water spray was evenly distributed. 

After discharge of the water (2,409 lb/3-min for 747-400), analysis indicated that all but about 430 lbs would 
either be absorbed by the cabin interior, exit via the outflow valve as saturated vapor, or remain in the cabin 
air as saturated vapor. After further analysis, is was determined that approximately 36 lbs of free liquid (0.132 
Ibm free liquid/lbm saturated air) could be ingested by the forward E/E supply fan (assuming no moisture 
coalesces into bigger droplets and separates out or impinges on the return air exit grills). After filtration of 
approximately 95% of the free liquid, the quantity of water discharged into the forward E/E bay was estimated 
to be approximately 1.8 lbm free liquid. The aft E/E bay has no filtration and could expect to see about the 
same quantity of water as the forward E/E equipment cooling supply fan. Even though similar results were 
found for the 767 through the same type of analysis, this scenario represents an “artificial worst case”, since the 
767 E/E bay is cooled in cruise via a skin heat exchanger, and does not receive any mist-laden air. Potential to 
ingest mist would still exist for the condition where skin temperature rises above 45°F, most likely during 
ground operations or takeoff, where equipment cooling reverts to forced air. 

5.3 ELECTRICAL SYSTEMS 

A cabin water spray damage assessment was performed to assess the impact of such a system on airplane 
operation following inadvertent, inflight operation and commanded operation on the ground. This part of the 
study was a high level investigation into the performance of 757 airplane electrical systems during and after 
water spray activation. Of primary concern is the continued safe flight and landing of the airplane, without 
exceptional pilot skill or strength, following inadvertent, inflight activation. The long term effects of corrosion 
were also addressed. 

1 he results ol the Electrical Systems study are based, in part, on prior in-service incidents involving fluid con- 
tamination of electrical systems, vendor qualification data and/or prior testing of specific electrical components, 
and review of failure modes and effects analysis (FMEA) reports on specific systems. 

5.3.1 Ground Rules and Assumptions 

Specific assumptions made for Electrical Systems evaluation are as follows: 

• Water electrical conductivity is minimized by the use of water with low salinity and mineral content; 

• Water that might affect electrical components is relatively free of dry contaminants (dust, 
minerals, etc.) 

• Water is introduced to the E/E bay equipment via mist laden air from the equipment cooling sys- 
tem, as well as drippage from the cabin area through the air vents, carpet and floor panels, onto the 
E/E racks and panels; 

• Equipment cooling system is assumed to remain operative during and after the water spray inci- 
dent, which raises some concern about fan stalling due to water quantity, and loss of blow-through 
cooling to specific rack mounted equipment, increasing the potential for malfunction. 
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5.3.2 Existing Contamination Protection Measures 

The current layout of the E/E bay includes protective measures designed to prevent component damage to all 
E/E equipment. Drip shields in the E/E bay are installed above each of the racks (Figure 53-1). Each shield 
consists of an aluminum pan (or canvas shield in the case of the 737), with a drain to the keel area. The en- 
closed panels are installed to allow water runoff from the racks to drain down into the fuselage. The racks and 
equipment enclosures are anodized for corrosion resistance. These protective measures currently allow the 
racks to tolerate any dripping or condensation that might be encountered in normal service, and assume a 
maintenance schedule for verifying drain function is followed. It is important to emphasize that these protective 
measures described refer to the “as-delivered” condition of the airplane. Evidence from inspection of older 
airplanes suggests that these measures may be compromised during their service life if maintenance procedures 
are neglected. Increased maintenance might be required to maintain even “as-delivered levels of protection. 
Potential consequences of improperly maintained drip shields include water that might normally be collected 
and directed away from electronics impinging directly on electronics, if the shield is missing or torn, and col- 
lected water splashing over rack mounted equipment at aircraft rotation, for cases wheie the drain might be 
restricted (Section 5.33.3). 



Figure 53-1- Fonvard E/E Bay. 
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Electrical equipment (relays, switches, connectors, circuit boards, wire, etc.) and their installations were re- 
viewed for water spray susceptibility. Connectors currently in common use include grommet seals designed to 
prevent water ingress, and should not be affected by the presence of moisture. Relays are hermetically sealed 
with grommets on the relay sockets, and circuit boards are often fabricated with a conformal coating, both 
treatments for the specific purpose of preventing contamination by moisture. No deleterious effects are expect- 
ed from the estimated water quantities applied to these components. Plug-in integrated circuits and board 
connectors are currently open to moisture. The ingress of water at these points could cause at least temporary 
system malfunction, component loss, potential system loss, and any subsequent ramifications due to a combi- 
nation of these failures. Spurious or inconsistent signals to the flight deck may also cause the crew to respond 
improperly and create a more serious condition. 

Currently, electrical circuit separation is required for redundant systems as part of the aircraft’s safety philoso- 
phy. The airplane wiring design and installation must incorporate appropriate measures to minimize the effect 
of electrical wiring faults, including those induced by water, and to isolate fault damage and propagation be- 
tween redundant systems. Wet arc tracking tests have been conducted on general purpose wire insulation used 
by The Boeing Company. Treated tap water has not caused insulation arc tracking on any of these wires when 
tested according to Boeing Specification Support Standard BSS 7324. In-service damage to wire insulation has 
not been considered in the test procedures. 

Aircraft maintenance, modifications, and equipment repair could increase the risk of water spray contamination 
by unintentional compromise of existing protective measures. Design requirements aimed at minimizing con- 
tamination susceptibility or exposure are already utilized in aircraft systems, such as wire separation require- 
ments, wire installations incorporating drip loops in water prone areas, and system function redundancy. Fur- 
ther testing of electrical components, such as printed circuit card connectors, is recommended to determine if 
additional “waterproofing” measures would be needed. It should be noted that these requirements would 
probably be limited to only those systems deemed necessary for the continued safe flight and landing of the 
aircraft following an inadvertent discharge of a water spray system. 

5-33 Electrical Systems Susceptibility to Water Spray 

Several 757 electrical systems (power system, high lift control system, proximity switch system) w ere reviewed 
lor expected system degradation, if any, due to w^ater spray. A general description of each of these systems is 
given to show that the existing design features are somew r hat tolerant of the effects of w^ater spray. These fea- 
tures include system redundancy, physical and functional separation, and system fault protection. Some specific 
components of these systems were then reviewed and commented on regarding the effects of water spray, if 
any. The 737 has similarly functioning systems, and any conclusions drawn for the 757 w ; ould apply. 

5.3.3. 1 757 Electrical Power System 

5 . 3 . 3 . 1 . 1 Primary AC System 

The primary ac system is a three-phase, four wire, wye-connected system that operates at a nominal voltage of 
115/200V and at a nominal frequency of 400-Hz. The generator neutral point is grounded to the airplane struc- 
ture and the airframe acts as the fourth wire. The system is divided into two main ac channels: the left channel 
and right channel. Each channel consists of a main ac bus supplied by an associated integrated drive generator 
(IDG). The two-channel system is designed for isolated operation (Figure 5.3-2). 
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Figure 53-2. Electrical Power System . 


An auxiliary power unit (APU) driven generator provides dispatch capability if one primary source IDG is 
inoperative, and, in addition, provides a self-sufficient power source for ground operation. This generator can 
supply electrical power to all main buses when the auxiliary power breaker (APB) and the bus tie breakeis 
(BTB) are closed. 

The system is designed for automatic operation to minimize flight crew workload. Manual override capability is 
provided for all automatic features except for automatic dc tie control. 

Both main ac buses can be supplied concurrently from any one of four isolated power sources (left and right 
engine generators, auxiliary APU generator and external power source) by means of the interconnecting ac tie 
bus when the appropriate generator control bus (GCB), APB, BTBs and external power contactors (EPC) are 
closed. Operation of these contactors is controlled automatically by the three generator 
control units (GCU), and the bus power control unit (BPCU) to maintain power on the buses from any avail- 
able source. 

Considering water spray through the equipment cooling system, the potential impact to a GCU located on the 
E5 rack is as follows: 

• Based on field experience with GCUs similar in construction to the 757/767 control units, when 
these units ingest fluids they may fail, resulting in a trip and transfer of the ac bus. In one reported 
case, the fault continued long enough to experience excessive heat, resulting in a scrapped unit. 
Because of the extent of the failure, the unit also did not transfer the ac bus, resulting in the loss of 
that bus. 
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5. 3.3.1. 2 Primary DC System 

A nominal 28V-clc power system is provided to supply loads requiring dc power (Figure 5.3-2). 

The dc main system is a 2-wire system which uses the airframe structure as the ground return circuit. It is 
divided into the left and right channels. Power is supplied to the dc loads by two 120 amp unregulated trans- 
former rectifier units (TRU), that are energized from the left and right 115V main ac buses, respectively, 
through thermal circuit breakers. Each TRU powers an associated main 28V-dc load bus. Under normal system 
operation, the dc battery bus, the dc standby bus and the dc center bus are supplied from the left main dc 
distribution bus. The TRUs are normally operated isolated to supply their respective load buses. 

A dc tie bus and an automatic dc tie control unit and contactor are provided to permit a single TRU to supply 
all dc buses if required. The dc system is not designed, however, for dispatch with an inoperative TRU. The 
inherent demonstrated reliability of the TRU makes this requirement unnecessary. 

No switching relays or contactors are provided in the ac input or dc output of the main TRUs, and the three- 
phase input wiring to each TRU is protected by a three-phase thermal circuit breaker. No protection devices 
are installed on the dc output feeder between the TRU and the dc bus. This feeder is adequately sized to carry 
dc fault currents up to a level that will cause the three-phase input breakers to trip. Each TRU is designed to 
deliver a short circuit current to clear the largest size thermal circuit breaker (100 amps) in the dc distribution 
system without damage to the unit, and without tripping the three-phase input breakers. 

Several components, listed in Appendix B as standby powered systems, and defined by Product Safety as 
required for safe flight and landing, were reviewed for the implications of water ingress based on a worst case 
scenario of the failure of the centrifugal separator used to eliminate particulates from the E/E cooling air (Sec- 
tion 5.2.1). This failure would result in increased quantities of moisture directed at these key components. This 
analysis was prepared by the ECS group, and summarized in Table 5-3-1, and results were used in several of 
the following sections. 


Table 5-3-1- Electronics Misting Summary ( Assume No Filtration ). 


Component Name 

Mist Ingestion Rate 
(Ibm/min) 

Flap/slat electronic unit (FSEU) 

0.14 

Transformer rectifier unit (TRU) 

0.61 

Control system electronic unit 
(CSEU) 


Power supply 

0.11 

Spoiler 

0.02 

Yaw damp 

0.04 

Stabilizer/aileron 

0.03 

Rudder ratio 

0.01 

Proximity switch electronics unit 
(PSEU) 

0.123 
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Considering a water spray that deposits 0.61 lbm per minute for 3-minutes (Table 5.3 1) at the TRU, the poten- 
tial impact is as follows: 

• There are no “bathtub” type water collection features in the design. Therefore, the substantial ma- 
jority of the water would immediately drain, leaving no collections of water except what surface 
tension alone would support. While operating, the unit is very warm and it is thought would tend 
to dry itself out. 

• In general, the components contained within the TRU are not moisture failure susceptible. The 
magnetics are varnish impregnated, the rectifier diodes hermetically sealed and the output capaci- 
tors are sealed. There are no circuit boards in this unit. 

• The TRU is a low impedance unit. A water bridge across terminals (or other electrical potentials) 
would create a relatively high impedance parallel path and thus have little performance or damag- 
ing affect on the unit. 


In summary, the unit would operate without noticeable performance effects. The unit would tend to dry itself 
out quickly (especially while operating). No permanent damage would likely result. The unit should be thor- 
oughly examined and tested after a system discharge and be repaired or replaced as required. 

5.3.3.I3 Standby Electrical System 

A standby power system is provided to supply 28V-dc and single phase 115V-ac power to essential instrument, 
communication and navigation equipment in the event of complete loss of primary ac power (Appendix B). 
This system is supplied by a 40 amp-hour nickel-cadmium battery, and consists of the standby battery and 
battery charger, battery current monitor, a single phase 115V-ac, 400-Hz, 1000 volt-amp static inverter, various 
control relays, the hot battery bus, battery bus and ac and dc standby buses. A functional diagram of the stand- 
by system is shown in Figure 5.3-3. The static inverter functions to convert nominal 28V-dc power from the hot 
battery' bus (or the dc left main bus) to single phase, 115V, 400-Hz ac power. 



L-dc 

bus 
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Considering water mist of 0.1 gallons in the forward E/E bay (Figure 5.2-3), the potential impact on the static 
inverter located in this area and draw through cooled is as follows: 

• Based on rain tests with similar equipment, conformal coating, salt spray and humidity test results, 
the supplier speculated there would be no effect on the units performance. 

5-3.3.1.4 Equipment and Installation for the 757 Electrical Power System 

Equipment associated with the electrical power system is installed in the 757 airplane at the various locations 
shown in Figure 5.3-4. This equipment is connected with different wire and connector types, each suited to the 
installation location. Wire routing and installation practices follow the wire separation criteria developed for the 
757 airplane. 



The wire types used in the 757 airplane comply with the applicable Boeing Material Specifications (BMS). The 
wire types are compatible with the electrical and environmental requirements of the area in which they are 
installed. 

Wires are grouped into bundles in accordance with the functional separation categories defined in Boeing 
separation requirements. The major separation categories are left channel, right channel, and standby system 
channel. Further separation between redundant circuits, and for electromagnetic compatibility reasons is also 
observed. Separation in consideration of a water threat is not currently considered, except in immediate prox- 
imity to current aircraft water systems (potable water and sanitary systems). 

Generator feeders are installed such as to provide separation of at least 3-inches from lines carrying fuel, hy- 
draulic fluid or oxygen. To prevent mechanical strain on feeders and their terminations and supports, slack is 
provided in the cables, and feeder clamps and guides are designed to allow axial movement of the feeders. 
Major feeders, such as the generator feeder wires and the tie bus, are separated from all other wire bundles. 
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Power distribution wiring associated with the right, left and standby channels is separated from each other. The 
power wiring interconnecting the standby battery and inverter, the hot battery, dc standby, ac standby, ac 
center, and dc center buses is separated from all other power wiring. 

5.3.3. 1.5 System Fault Protection 

The 757 airplane wiring and equipment installation practices incorporate appropriate measures to minimize the 
effect of electrical faults, and to isolate fault damage and propagation between redundant systems. The main 
wire bundles in the 757 electrical system are physically isolated so that damage in any single wire bundle will 
not result in disabling wiring in other wire bundles. 

All flight essential electrical equipment on the 757 airplane is provided in dual or triple redundancy, and redun- 
dant units are connected to separate power sources (left and right ac and dc buses). Triple redundant systems 
are connected to left, right, and center isolated buses. 

Batteiy and standby buses are normally powered by the left ac and dc channels, but will transfer automatically 
to the battery/inverter system in the event of a left channel failure. 

Non-essential loads such as galleys, passenger entertainment, etc., are connected to special bus sections which 
can be de-energized (shed) automatically or manually, thus providing added assurance of adequate power for 
essential loads during abnormal operating conditions. 

5.3.3. 2 757 High Lift Control System 

The 757 high lift system includes double slotted inboard and outboard trailing edge flaps, and one inboard and 
four outboard three position leading edge slats on each wing. The hydro-mechanical control/drive system 
provides normal flap/slat control, with an electrical control/power system providing alternate (back-up) con- 
trol. Both modes are monitored lor proper operation. 

Flaps and slats are normally controlled by a single detected flap control lever. Commands are mechanically 
transmitted to a single trailing edge power drive unit (PDU) that drives a torque tube system. Each flap is driv- 
en by two ball-screw actuators from the torque tube. “No-back” devices maintain flap position with loss of 
power. Slat commands are mechanically transmitted from the trailing edge flap PDU output to a single slat 
PDU that also drives a torque tube system. “No-back” devices maintain slat position with loss of power. Alter- 
nate control is from a rotary selector switch and separate flap/slat arming switches. Alternate control is closed 
loop. Flaps and slats are powered by electric motors that drive the flap and slat torque tubes. The high lift 
system is normally depressurized at flaps up conditions. Flap/slat position indication is provided by a single 
indicator. Electrical control and monitoring functions are implemented in a flap/slat electronics unit (FSEL) 
using digital technology. 

The FSEU (Figure 5.3-5) installed in the E/E bay consists of three physically and functionally isolated, 
identical channels. 
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Electrical and electronic systems provide alternate drive power, alternate control functions, system position 
indication, failure detection, failure annunciation, failure protection, autoslat and flap load alleviation control, 
and high lift system information to other airplane systems. All three electrical power sources (main, APU, stand* 
by) are used to power various high lift system components. The power sources are distributed in such a way 
that no single electrical failure will prevent deployment of the high lift system. 

The high lift system failure analysis presents the system hazard assessment of the effects of any single failure, 
multiple failures, and critical failure combinations with their associated probabilities. Failures of high lift system 
components are analyzed for their effects on the system and, if necessary, verified on the flight controls test rig 
and in avionics laboratory testing. Effects on airplane controllability are determined using piloted simulator 
studies. Significant failure mode effects are verified during flight testing. Individual system component failures 
are analyzed where possible, on a general failure basis, rather than analyzing each pa it of each component. 
Failure mode effects on systems that interface with the high lift system are also considered on a generic level. 

The high lift device system is required for dispatch. Loss of this function inflight would require flight envelope 
restrictions. Certain combinations of failure must be shown to be extremely improbable to ensure continued 
safe flight and landing without exceptional pilot skill or strength. Loss of normal and alternate high lift control 
will require flaps up landing. Flap or slat asymmetry will require use of the alternate control system and 
abnormal operation procedures. The level of criticality of the 757 high lift system is commensurate with FAR 
25.1309b (2) since inflight loss of function will permit continued safe flight and landing. 
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Considering a water spray that deposits 0.14 lbm per minute for 3-minutes (Table 5.3 1) at the FSEU, the poten- 
tial impact is as follows: it is assumed that water will spray or drip into all three FSEUs (Section 5 9.2). The 
effect of water on the FSEUs is unpredictable. Water may cause shorting between pins on the connectors in the 
FSEU, causing unpredictable circuit function. Enatic outputs to user systems, spurious flight deck indications, 
shutdown of the leading and trailing edge devices or possibly uncontrolled flap/slat movements are possible 
effects of this internal shorting. A worst case scenario would be the shutdown of all three units. While it is 
possible that the flaps and slats would be shutdown in place, due to FSEU command, it is likely that primary 
control of the flaps/slats would be retained. It is highly improbable that uncommanded flap/slat motion would 
occur due to FSEU shutdown. As the FSEUs provide primary flap/slat position indication, alternate (electric) 
flap/slat control and position indication and uncommanded motion (UCM) and asymmetry protection, pnmary 
control would likely be retained. Continued safe flight and landing would be possible as primary control of the 
flaps/slats would likely be intact, albeit without UCM or asymmetry protection. Other systems dependent on 
FSEU outputs may also be disabled. 

In order to return the FSEU to service it should only be necessary to dry the unit and perform a component 
functional test to verify proper performance. Design changes necessary to preclude FSEU failure due to water 
spray include environmentally sealed connectors and possibly an environmentally sealed chassis, which w ould 
have a significant effect on thermal management. 

5-3.3.3 757 Proximity Switch Electronic Unit (PSEU) System 

'lire proximity switch system is primarily used for position sensing of items such as landing gear, thrust revers- 
es and doors. The system consists of position (proximity) sensors installed on the landing gear, thrust reversers 
and doors and an electronic unit (the PSEU) installed in the E/E bay (Figure 5-3-6). The sensors sense the 
proximity of targets installed such that switching is accomplished without physical contact between the sensor 
and target. The PSEU senses target near or target far, and outputs signals that interface with airplane systems. 
The PSEU has BITE for identifying faulty components. 
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Within the PSEU are eight separate subsystems, each having its own power supply. No components in any 
subsystem are used by any of the other subsystems. The eight subsystems in the PSEU are: 

• Cargo door control; 

• Door warning indication; 

• Thrust reverser indication - left; 

• Thrust reverser indication - right; 

• Thrust reverser auto restow - left; 

• Thrust reverser auto restow - right; 

• Landing gear position No. 1; 

• Landing gear position No. 2. 

Failures in the PSEU may cause either an output to conduct when it shouldn’t or not conduct when it should. 
This is equivalent to short (to ground) or open circuits at the respective output connector pins of the PSEU. 

Considering a water spray that deposits 0.123 lbm per minute for 3-minutes (Table 5.3-1) at the PSEU, the 
potential impact is as follows: circuit boards inside the PSEU are all equipped with a conformal coating and 
thus are unaffected by moisture. Card edge connectors for these cards are not water tight, and thus may pro- 
duce sporadic results. A subsequent fire is unlikely, as the circuit breakers will open before this occurs. 

Two types of problems may result from water exposure: 

• Sporadic/wrong flight deck indications (e.g., landing gear unsafe, doors open, every engine indica- 
tion and crew alerting system (EICAS) message imaginable). 

This first type of problem is somewhat unlikely as the same shorts would have to occur to both System 1 and 
System 2 (located on different cards), but it is possible. The more likely result will be EICAS messages an- 
nouncing a difference between the two systems. 

• Sporadic/wrong air-ground data: (e.g., it thinks it’s in the air when actually on the ground or vice 
versa). This failure is much less likely as more of the same shorts would have to occur to both 
systems, thus allowing, but not causing, certain systems to operate when not intended, or prevent- 
ing certain systems from operating when needed, e.g., preventing the pilot from deploying the 
thrust reversers on the ground or allowing the pilot to retract the landing gear while on the ground, 
or inhibiting certain equipment cooling or autobrake operations. It is important to mention that no 
system connected to the air-ground system is safety-of-flight critical, however, loss of this system 
will allow, but not cause, activation of systems in situations which could jeopardize safety-of-flight, 
e.g., flight deck commanded deployment of thrust reversers inflight, and is a significant degradation 
in aircraft safety. 

The longer term effects of water is undetermined, as any liquids would bring impurities into the unit and pro- 
mote corrosion. It is therefore recommended that the PSEU be cleaned, inspected, serviced and an acceptance 
test procedure (ATP) performed before readmittance to the airplane. 
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5.33.4 Interior Payloads Systems 

The effect on the interior lighting system is difficult to assess. Water from the spray system may be contaminat- 
ed by dust or other ionic species deposited on the equipment. These contaminants are conductive and capable 
of sustaining an arc. 

If the spray is accidently activated when the interior lighting is on then: 

• Lavatory, galley, ceiling and sidewall fluorescent lights may fail. Contaminated water may form an 
arc at the lamp holders until they diy out. Whether circuit breakers open or not depends on the 
duration of arc path. It would be advisable to shed utility bus power upon inadvertent water spray 
activation, to lessen the possibility of electrical arcing from equipment. 

• Reading lights may explode or break depending on the intensity of the thermal shock geneiated by 
the difference between water and the bulb temperature when reading lights are on. An arc may 
occur at the lamp terminal. 

• Information signs may short; 

• Emergency light battery packs, emergency lights and exit signs may be soaked with water and may 
become inoperative; 

• Emergency lighting systems may be lost, in whole or part, due to electrical shorts, and may result in 
a slowing down of an evacuation. The emergency lighting system may require recertification and 
modification as required for use with a cabin water spray system. 

533-5 Avionics 

There is an extensive history of fluid contamination in avionics. The most notable was a case where fluid 
flowed into the digital/analog adapters (DAA) from dripshields on a 737. Both DAAs failed upon takeoff rota- 
tion when water flowed onto the motherboard connectors and shorted out the components. All primary atti- 
tude indication was lost due to loss ot DAA data, a supposedly “extremely improbable event. This event liigh- 
lights the potential effects of fluid contamination with avionics. 

In tliis analysis there are two paths of fluid ingress: 

• Flowing in by gravity from above shelves, and; 

• Blown humidity or mist into actively cooled components. 

The primary failure mechanism will most likely be loss of dielectric strength between exposed conductors and 
printed circuit (PC) traces and loss of dielectric strength in ambient air. 

The loss of air dielectric strength is probably not likely unless there is a high voltage power supply (HVPS) 
present in the line- replaceable units (LRU). Arc over may occur in these LRUs with HVPS during high concen- 
trations of moisture contamination. These LRUs are the electronic flight instrument system (EFIS), weather radar 
(WXR), and control display unit (CDU) displays and inertial reference unit (IRU). All of these are actively 
cooled! If arc over does occur, the unit will most likely fail completely causing master warnings to the pilot. 

The majority of avionics may experience some degree of condensation or accumulation of droplets on the PC 
cards. Since the cards are provided with a conformal coating, this condensation probably will not cause erratic 
behavior or failure. Condensation occurs naturally and frequently due to the thermal cycling of units in and out 
of humid conditions. 
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A concern would arise if the droplets conglomerate and drip into board connectors. This would cause shorting 
like the DAA failures. LRUs with connectors perpendicular to the LRU bottom (vertical) would be less suscepti- 
ble to this failure mode. 

In newly delivered aircraft, the avionics are protected from overhead dripping by shields placed above the 
electronic racks. However, it these shields are not maintained properly water may drip into the equipment. 
Numerous instances of LRU corrosion and fluid ingress have been reported by airlines from this cause. 

If die units continue to operate even if contaminated, a secondary failure mode may become predominant. 

This failure mode typically manifests itself as corrosion within the LRU. 'Hie corrosion would be compounded 
by any existing dry contamination within avionics. 

The following are recommendations if CWS is to be implemented: 

• Either the cooling system or the avionics design of critical systems and their power sources must be 
changed to preclude avionics failure during flight given an accidental deployment of the system; 

• Qualification tests must be designed and conducted to prove avionics immunity to 
moisture contamination; 

• It is recommended that LRUs are cleaned and dried thoroughly after a discharge of the CWS system; 

• Proper maintenance of the dripshields must be emphasized. 

5*3.4 Return to Service Issues 

Following an inadvertent discharge of a cabin water spray system, certain steps would be necessary in a return 
to service program. Since the long term enemy of equipment from water impurities is corrosion, the electrical 
equipment determined to have been sprayed or affected by water must be thoroughly examined. Equipment 
must be inspected, cleaned, serviced, and repaired or replaced as required. A thorough component and system 
functional test must be performed. Wire bundles must be inspected for water contamination, evidence of wire 
overheating, or arc tracking, and repaired or replaced as required. Modification of the affected installation as 
required, such as re-orienting disconnects, adding drip loops, etc., will help preclude occurrence of water 
spray contamination. 

5.3.5 747/767 Airplanes 

An assessment of the other airplanes in the Boeing family was made to establish specific differences from the 
study baseline 757. Since the direction of the study became relatively generic, the conclusions drawn regarding 
electrical equipment and systems in the 757 can be applied to the other airplanes as well. However, two items 
which are unique to the 747/767 airplanes were specifically evaluated, and scenarios considering their damage 
or failure are presented here. 

The flight management computer (FMC) is a navigation and guidance system designed to allow the pilots to 
pre-program the desired flight plan, including routes, waypoints, and optimum efficiency flight profiles into a 
central data base which provides direction to the autopilot flight director system (AFDS). These systems are 
similar on 7T7 and 767 airplanes. Intent of these systems is to reduce pilot workload, and provide maximum 
fuel economy for a given flight. Design and construction of these system components is consistent with other 
electrical components previously described. Failure of the FMC or AFDS due to water ingress would require 
the flight crew to take manual control of the airplane, including all navigation and position calculations, throttle 
functions, etc. In short, the airplane would need to be flown by the flight crew, who would lose the conve- 
nience of automated flight guidance. This is not a “continued safety-of-flight” issue, but would most certainly 
require thorough checkout after a water spray discharge to prevent future anomalies. 
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The flight control electronic system (FCES), which is found on the 747 only, provides control indication and 
fault reporting for the airplane s control surfaces, as well as signals for flight control surface movement during 
autopilot flight regimes. In addition, control surface trim functions and flap positioning (leading and trailing 
edge) is controlled through the flap control unit (FCU) modules within the FCES. Once again, these module s 
construction is consistent with other electrical components, and are relatively moisture resistant due to design 
requirements imposed by standard 100% humidity test requirements. However, extreme moisture conditions 
could damage tire electronic cards by shorting connector pins. Since primary flight control is by mechanical 
means, loss of the FCES would not compromise major flight controls. As a worst possible case example, loss of 
all three FCUs due to shorting from water damage would require use of the alternate electric mode, with the 
flight crew operating flaps by bypassing the FCUs. Loss of the FCES would not compromise the "continued safe 
flight” of the airplane. 

53.6 Summary 

Study results conclude that the electrical equipment as presently manufactured and installed is somewhat resis- 
tant to a water spray system. Tire components are currently designed and qualified to meet similar specific 
requirements (e.g., humidity, salt water spray). One of the identified concerns from a system performance 
standpoint are the printed circuit card connectors within the equipment boxes (LRUs) and card files. These 
exposed contacts are vulnerable to shorting/arcing depending upon, but not limited to, such factors as the 
voltage levels present, tire electrical conductivity of the water, and the installation/orientation of the part. 
Boeing manufacturing processes are designed and implemented with an objective of minimizing the suscepti- 
bility of fluid contamination to the aircraft systems. The possibility exists, however, that a system electrical 
malfunction could occur if contaminated by water spray, resulting in erratic system behavior. The extent of the 
malfunction would need to be determined by testing (both laboratory and flight), and failure analysis. Tire 
electrical conductivity of the water spray is a factor of concern and should be minimized (e.g., use distilled 
water or chemical additives). The specific electrical systems discussed in this study were chosen because of 
their affect or inter-relationship on other aircraft systems. The efforts of this study resulted in the conclusion 
that some electrical system degradation or failures from water spray is likely, even with current or proposed 
protective measures, and do not necessarily preclude the continued safe flight and landing of the airplane, 
however, these failures can adversely affect current levels of safety. Rigorous testing is warranted to determine 
the modes and degrees of failure which might be expected following a water spray dischaige, and to identify 
protective measures which will make this type of degradation “highly improbable”. 

5.4 PROPULSION SYSTEMS 

This section presents a study of the effects of cabin water spray discharge on 757 propulsion system compo- 
nents. The purpose of this study is to determine the potential failures in the propulsion system that would 
affect safety-of-flight. The potential failures that are common to other current production airplanes are also 
briefly discussed. 

5.4.1 Introduction 

No component of the propulsion system is located in the defined spray area, however, certain propulsion 
system controls and indicators could be subjected to mist absorbed by the ECS and/or to watei spills or drip- 
ping of water through the floor panels. These components are located in the forward and aft E/E bays and 

die cockpit. 

Based on the Electrical Systems group’s findings (Section 5.3), only the plug-in integrated circuits and board 
connectors in the E/E bays are particularly susceptible to moisture. Connectors and relays are protected by 
grommet sealing and circuit boards are provided with a conformal coating. E/E racks are equipped with drip 
shields and drains installed above each rack, and the E/E panels are fully enclosed and installed to channel 
water runoff down the back of the panel. It must be emphasized these findings are based on the delivered 
configuration only and they may not hold true throughout the life of the airplane, e.g., the drip pans may be 
removed and not replaced, become tom or clogged, or seals broken as a result of maintenance actions. 
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During these evaluations, it became clear that prediction of modes and degrees of failure is difficult without 
actual testing of specific cases. This section of the report contains speculations of worst case failures. Section 
5.4.2 contains a brief overview of each of the identified components’ functions, and modes and effects of the 
worst cast failure. 

5.4.2 Discussion 

5.4.2. 1 E/E Forward Bay Equipment 

The Propulsion System items in the electronic equipment forward bay include: 

5.4.2. 1.1 Propulsion Discrete Interface Unit (PDIU) For 757 Pratt & Whitney (PW2000) 
Installation Only 

The PDIU, located in the E/E bay, is a digital processor that collects, processes and converts airframe analog 
discrete data signals to an ARINC 429 digital bus data format for use by electronic engine control (EEC), and 
provides data from one engine for the other engines starting. In the event that the unit fails, the EEC replaces 
the inputs with default values, and the starters have to be operated manually. In the event of erroneous outputs 
from the PDIU, the EEC is unable to detect errors, thus the EEC may reduce engine thrust slightly. None of 
these en'ors would result in an engine shutdown. 

5. 4.2. 1.2 EEC For 757 Rolls-Royce Installation Only 

The EEC for the Rolls-Royce, RB21 1-535 main engine provides limiter and supervisory control. The supervisory 
control provides automatic rating protection and controls the fuel flow torque motor to match the engine 
pressure ratio (EPR) set by EEC. The limiter control drives the torque motor to maintain the engine N x (low 
rotor speed). 

If the supervisory control detects a failure, the limiter freezes current to the torque motor and the pilot is 
warned by a lamp. There is no need for immediate action from the pilot, but he must eventually revert to 
limiter control. To do this, the pilot must first back off the throttle and then press the supervisory control INOP 
reversion switch located on the overhead panel. 

In the event that the limiter should fail, the fail-fix solenoid hydraulically freezes the trim existing prior to the 
failure. Again, there is no need for immediate action from the pilot, but he must eventually revert to hydrome- 
chanical control. To do this, the pilot must first back off the throttle and then press the limiter control INOP 
reversion switch located on the overhead panel. 

The two EEC units are located in the E/E bay. Present operating policies allow the airplane to be dispatched 
with one inoperative EEC, per minimum equipment list (MEL). 

5.4.2. 1.3 Engine Indication and Crew Alerting System 

The EICAS system includes two CRT display units located on the flight deck, and two independent computers. 
The purpose of this system is to provide the flight crew with primary engine parameters (full time) and with 
secondary engine parameters and warning/caution/advisory messages (as required). 

The two EICAS computers are co-located in the same rack. Therefore, in the event of water spray activation, 
the potential for common cause failure from spray contamination (Section 5.9) exists with the current configu- 
ration. Section 5.3 outlines likely effects from water ingress into sophisticated electronic components, such as 
the EICAS computers. 
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The EICAS computers are considered essential safety-of-flight systems. Present operating policies allow the 
airplane to be dispatched with one of the display units, or one of the computers inoperative (i.e., one of four 
components inoperative). A standby engine indicator is a third back-up system that displays the primary engine 
parameters necessary for continued safe flight. 

5.4.2. 1.4 Electrical Relays, Connectors and Wiring For EEC Channel Select and Fuel Shutoff 

The fuel shutoff circuitry controls the fuel flow to the engines. Circuitry malfunctions could, in a worst case 
scenario, cause a fuel shutoff and eventually de-power an engine, resulting in uncommanded loss of power. 

The EEC channel select circuitry (for PW installations only) allows die pilot to switch the PW EEC to the sec- 
ondary channel. The secondary channel, however, may not be operational at all times, specifically because it is 
acceptable under present policy to dispatch an airplane with one channel inoperative. Therefore, in it’s current 
configuration, it is possible to have an engine shutdown if the EEC fails into the secondary channel mode, and 
the secondary channel is inoperative. 

5.4.2. 1.5 Fuel Quantity Indicating System (FQIS) 

The FQIS displays the fuel quantity, and alerts the flight crew to low fuel quantity, fuel imbalance, and fuel 
system component failures. In the event of a FQIS unit failure, as might be expected with water damage, it is 
possible for EICAS to display an enoneous LOW FUEL caution alert and/or for the FUEL CONFIG light to fail 
to illuminate. A LOW FUEL caution indication is taken very seriously, with the airplane diverted to the 
nearest airport. 

5.4.2.2 E/E Aft Bay Equipment 

The propulsion system item of concern in the E/E aft bay is: 

5.4.2.2.1 Auxiliary Power Unit Full Authority Digital Electronic Control (APU FADEC) 

Tire APU FADEC is an integral component of the APU control system, providing speed control, surge and 
inlet guide vane (IGV) control, and shutdown protection. A malfunction in the unit, such as have been de- 
scribed in Section 5.3, could result in an uncommanded shutdown of the APU, if running when required by 
ETOPS procedures. 

The APU is a small auxiliary engine that provides pneumatic flow for main engine starts, environmental condi- 
tioning, and shaft power to drive an electrical generator. It is generally used on ground prior to main engine 
start. Inflight, it is used as a backup system only, and an aircraft may be dispatched without an operational 
APU, unless that airplane is flying on extended-range twin operation (ETOPS). For ETOPS airplanes, the APU is 
considered a necessary backup system, should there be a main engine failure. The APU for 737 and 757 (as 
required) ETOPS airplanes must be running at altitudes greater than or equal to 25,000 ft, when die airplane is 
flying in extended range operation. 

5.4.2.3 Flight Deck Equipment 

The flight deck area is not in die defined spray area, and the presence of water there is unlikely. However, the 
propulsion system components on the flight deck include: 

5.4.2.3.1 Resolvers For Thrust Controls For Pratt & Whitney Installation 

Resolvers supply electrically isolated dirust command signals (thrust lever resolver angle) to the engine fan case 
mounted EEC. These angles are provided by the thrust levers. Each resolver has two inputs, one per each 
channel of the EEC. The resolvers are hermetically sealed and rubber inserts in their connectors prevent mois- 
ture penetration. 
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The system is vulnerable to failures resulting from water damage, however, at wiring and connectors that con- 
nect the resolvers with the EEC. This wiring ains through the pressure hull, and is subject to many of the spray 
concerns addressed in Section 5-3- Additional concern, as stated in Section 5.2.1, is that measures designed to 
isolate the flight deck from threats such as this are compromised in-service, thus increasing the potential for 
water ingress on the flight deck and the failure of critical systems then being very high. While it is unlikely that 
a trace of moisture would have any negative effects with currently in-place protective measures, in a worst case 
scenario, the engine could revert to idle thaist. 

5.4.2. 3. 2 Fuel Control Switch 

This switch controls the fuel flow' to the main engines, and a malfunction such as an electrical short could lead 
to a main engine shutdown. As stated previously, the definition of the spray area should preclude any such 
event as long as the proper flight deck isolation measures are not compromised. 

5.4.3 747/767 Airplanes 

The previous discussions regarding the fuel shutoff circuitry in the E/E bay, the resolver signals, and the fuel 
control switch in the flight deck are applicable to all 747/767 models. Therefore, a re-evaluation of the current 
protective measures for all of these airplanes is required to assure safety. 

5.4.4 Summary 

Additional moisture-proofing protective measures may be required for the components in the EEC channel 
select, fuel shutoff and resolver circuit, and fuel control switches because a failure in one or more of these 
components could possibly result in a loss of main engine pow r er. Considering the possibility of common cause 
failure (Section 5.9.2), it is not unreasonable to project to the potential for loss of all engines, and the possi- 
bility for an un-pow'ered, off-airport landing. Past incidents of this nature have resulted in fatal accidents. 

In the aircraft’s delivered configuration, these components are protected from moisture in various w^ays (Sec- 
tion 5.3.2), but it is possible for these protective measures to be unintentionally compromised as a result ol 
aircraft maintenance and repair. The belief, based on available data, is that any malfunction in the remainder of 
the identified propulsion components that would affect the continued safe operation of the engines is highly 
improbable. Some of these malfunctions could slightly degrade engine performance, while other malfunctions 
might l)e considered tolerable because of existing system redundancies. Propulsion recommends extensive 
testing to verify the adequacy of all current protective and backup measures. Furthermore, all the recommen- 
dations for minimizing water ingress made in the electrical section are endorsed here. 

5.5 FLIGHT CONTROL SYSTEMS 

5.5.1 Inttoduction 

This portion of the study was conducted to determine the potentially negative effects that an activation of a 
cabin w'ater spray could have on flight controls of the 757. Inadvertent activation was studied for its effect on 
continued control of the airplane; for taxi back to the ramp in the on-ground case, or the continued safe flight 
and landing for the inflight case. Suggested methods by wiiich the negative effects could be reduced are in- 
cluded herein. Because of system design similarity, disbenefits described for the 757 will also apply to 737, 747, 
and 767, in the broad sense. The fly-by-w r ire architecture for the 777, however, will be addressed separately. 
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5.5.2 


Assumptions 


Water from the cabin water spray system was considered to be confined to the pressurized fuselage of the 
airplane, excluding the flight deck (Section 5.2.1). Therefore, equipment located in the wings, fin, or stabilizer, 
is not expected to be affected. Since it is impossible to predict precise water paths following discharge, the 
assumption was made that if a component could be effected by water, it would. Cabin water spray is assumed 
to be a one-time event only, and, repeated sprays leading to part corrosion are not considered. Inadvertent 
inflight water spray in conjunction with other system failures was not considered in this analysis, but multiple 
failures have, in past incidents, been the cause of numerous fatal accidents, and should not be trivialized. 

5.5.3 Background 

The flight controls systems on the 757 consist of the following: ailerons, configuration warning, elevator, hy- 
draulics, leading-edge devices, mdder, spoilers, stabilizer, and trailing-edge devices. Primary control surfaces 
are hydraulically powered, and controlled by cables for airplanes other than the 777. 

The flight controls system is made up of a complex interaction between electronic, hydraulic, mechanical and 
avionics equipment. Switches and mechanical levers on the flight deck communicate to pulley cables and 
avionics components such as the flight control computers. These, in turn, communicate electrically or mechani- 
cally with hydraulic actuators, valves, reservoirs, pumps and other equipment. Electronics also perform system 
monitoring and fault analysis, monitor inputs for air speed and control surface position, and provide flight 
deck warnings. 

A failure in one piece of equipment, due to cabin water spray, may affect not only the operation of that part, 
but can also impact other equipment. This is especially true in the case of electronic equipment. Prediction of 
all possible effects of water spray on equipment is not possible when the configuration of the cabin water 
spray system is not known. However, some generalizations and predictions ot failure are possible, and their 
implications can be assessed. 

5.5.4 Failure Prediction 

All flight control equipment in the pressurized area was reviewed to assess the possibility of malfunction when 
exposed to water. Most mechanical and hydraulic equipment, such as the ram air turbine or hydraulic reser- 
voirs, are water-resistant by design. However, there are two types of failures which potentially could occur if 
the flight controls equipment is exposed to water. These are: 

• Water freezing on cables preventing movement of the control surface hydraulic actuator; 

• Electronic part failure or malfunction. 

Freezing water would most probably te found only on the pulley cables at the points where the cables travel 
from the pressurized area to the unpressurized area. In these areas, small amounts of moisture could freeze. 
This should not restrict the use of the cables for two reasons: 1) it is unlikely that the ice will be in such a 
quantity as to inliibit primary cable movement; 2) if primary cable movement is inliibited by ice, then backup 
cables, breakouts, etc. will protect against cable jams. 

Ice formation is not expected to occur in other sections of the pressurized area. Outside the pressurized area, 
parts are designed to withstand ice formation. 
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The second type of failure which could occur is failure of electronic parts when exposed to water. Some elec- 
tronic equipment is moisture tolerant and would most likely not be affected. Other equipment may be affected, 
but is not considered to be critical to the system. However, several parts could possibly malfunction if exposed 
to water. Most of the electronic equipment which might be expected to fail is located in either the electronics 
bay, or the flight deck, which is out of the defined spray area. Failure of equipment in the electronics bay, due 
to an inflight cabin water spray, could cause situations that are difficult to control or are confusing to the flight 
crew. Several modules may be sensitive to a cabin water spray during flight. A brief discussion of these mod- 
ules, and the implications of malfunction, are discussed here: 

• Flap/slat electronics unit - in the worst case (all three units fail) unpredictable circuit function could 
occur, possibly resulting in erratic flight deck indication (Section 5.33.2). 

• Proximity switch electronics unit - failure could cause sporadic/wrong flight deck indications or 
sporadic/wrong air-ground data (Section 5333). 

• Stall warning module - failure of both modules could result in a failure of the control column to 
warn the pilot by vibrating when a stall condition is being approached. Other flight deck indicators, 
however, also warn of a stall condition and failure of this module will not affect continued safe 
flight of the aircraft, however, overall levels of safety 7 will be reduced. 

• Control systems electronics unit - these two units contain modules such as the yaw damper, rudder 
ratio changer and the spoiler control. The airplane can be controlled safely without the use of these 
modules. Failure of the spoiler control module results in spoiler shutdown, thus preventing uncon- 
trolled spoiler movement. Failure of these modules could result in sporadic flight deck messages 
and could result in a higher workload for the pilot. 

• Stabilizer trim/elevator asymmetry module (SAM) - failure of SAM would result in the pilot having 
to control the stabilizer manually, through back-up cables. SAM also provides airspeed inputs to the 
rudder ratio changer modules and elevator asymmetry modules. It is highly unlikely that SAM 
would provide incorrect data to these modules, but this possibility must be considered. 

• Flight control computers - failure of the flight control computers would prevent auto-pilot control 
of the stabilizer and elevator. However, manual operation would not be hampered. 

• Engine indication and crew alerting system (El CAS) — EICAS is a system which alerts the crew to 
faults and failures in the aircraft systems, including flight controls systems. Failure of EICAS could 
result in erroneous signals of the flight deck EICAS display. 

• Configuration warning modules — These two modules process input signals from airplane sensors, 
avionics systems, and pilots to determine if the airplane is in the correct configuration for takeoff 
and landing. Aural and visual warnings appear on the flight deck if the airplane is incorrectly con- 
figured. It is unlikely that these modules would give a false warning of a configuration error. Failure 
of these modules will not prevent the pilot from safely flying the aircraft, but could cause confu- 
sion, or may not warn the pilot of a configuration error. Other indicators on the flight deck, howev- 
er, would also warn the pilot that the airplane was not configured correctly. 

A failure in any one of these modules is not expected to create a situation wliich the pilot cannot control. 
However, the workload of the pilot would almost certainly be increased, and levels of safety 7 reduced. Failure 
of more than one unit could have greater effects than are predicted here, and could, in a worst case scenario, 
cause uncontrolled movement of some surfaces. 
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5.5.5 


Mitigation of Disbenefits 


The electronic components in the flight controls systems that are at risk from a water spray system can be 
protected from part failure by sealing the electronic parts against water, ensuring that electronics bay units 
cannot be damaged by water sprays. These steps are discussed in Section 5.3, however, as outlined there, 
absolute water proofing measures could affect overall thermal management within the bay. To offset this prob- 
lem requires knowledge of the installation of the cabin water spray system. Once the system configuration is 
known, testing must be performed to determine where the water is likely to collect and the total amounts of 
water involved. This will allow for a more detailed look at how parts could fail, and those that are more likely 
to fail. From these tests, design practices can be modified to prevent ice build up or water collecting near 
sensitive equipment in such a way as to avoid negative effects on other aspects of systems design. 

5.5.6 777 Fly-by-Wire System 

Unlike the other Boeing aircraft covered in this study, the 777 uses a fly-by-wire system to command the pri- 
mary control surfaces, and includes minimal mechanical back-up. One pair of spoilers and the horizontal stabi- 
lizer do have pulley cable back-ups. However, in calculating probability of system failure, no credit has been 
taken for these mechanical back-ups. 

Operation of primary flight controls is accomplished through the actuator control electronics (ACE) equipment. 
This equipment consists of LRUs, mounted on racks in the aircraft's E/E bay. Construction is similar to other 
electronic components described in Section 5.3, and is subject to many of the same concerns. Connectors have 
been identified as the vulnerable element in any electronic component, and remain so here. Clean, contami- 
nant free water, as might be experienced in component testing programs, carries a relatively minor threat po- 
tential. For an in-seivice aircraft, the threat from contaminant laden water is significant. Contamination of con- 
tacts by debris transported in water deposited on these metal contacts can result in undesired bridging across 
pins, with degraded signals and cross-talk die likely results. Also, as described in Section 5.9, the potential for 
common cause failure is introduced, and the layout of die E/E bay equipment must take this threat into consid- 
eration, to assure the proper levels of redundancy among the system’s components, and to assure functionality 
for continued safe flight. 

In summary, it is inappropriate to discuss the susceptibility of die fly-by- wire electronics to damage from water 
spray, since incorporation of this system will require substantial design effort to incorporate die appropriate 
protective measures already discussed in Section 5.3 into vulnerable components to avoid a loss-of-control 
accident. 

5.5.7 Summary 

Inadvertent inflight activation of a water spray system can cause malfunctions to the airplane’s flight control 
systems. A further system review will be required if a detailed water spray system is to be configured. As with 
any new system added to an already complicated aircraft, each change and its effects will have to be analyzed 
on an individual component basis, and for the effects that any one failure might have on odier systems and 
their impact on continued safe flight. 

5.6 STRUCTURES 

This section of the report presents the disbenefits to the airplane from a structures perspective, and covers 737, 
747, 757, 767, and 111 models. All items discussed are irrespective of the water spray activation scenario, since, 
from a purely structures point of view, the only real point of concern is the time allowed to pass before a 
complete teardown for diying, elimination of the potential for corrosion as quickly as possible being the goal. 
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5.6.1 Assumptions 


Water used in the spraying process is considered to be of low salinity and acidity and free of compounds that 
would have a significant impact on the speed of any corrosive process. Second, the reconditioning process 
following a water spray event would begin immediately, and not be delayed for attention during subsequent 
periodic structural examinations. Finally, an unwarranted water spray activation would be treated as a serious 
event, and not a minor inconvenience. Corrosion damage caused by “minor” liquid spills and lavatory over- 
flows has been shown to be a significant problem for airline maintenance programs, and the subject of numer- 
ous “fixes” by airframe manufacturers. It is therefore assumed that the reconditioning following a water spray 
discharge would be an aggressive program aimed at eliminating any long term effects. 

5.6.2 Structural Considerations 

5.6.2. 1 Fuselage Structures 

There are no significant, near term structural problems which might occur due to a water spray deployment, 
inadvertent or otherwise. The long term concern is water trapped in the structure that could result in increased 
corrosion potential. Elaborate protective measures have been developed and implemented over the years to 
protect areas below doors, galleys, and lavatories from the effects of seemingly “minor” liquid spills. On later 
model 737s and 747s, all 757s, 767s and future 777s the majority of the upper and lower lobe structure is pro- 
tected by corrosion inhibiting compound (CIC) such as LPS3, that is applied during construction and needs to 
be re-applied every 2 to 5 years, depending on location. Re-application of this CIC is usually done with normal 
preventative maintenance and overhauls. 

As described in Section 5.1, an unknown quantity of water is expected to leak through floor panels, after satu- 
ration of the passenger cabin carpeting. Although the main deck floor panels are sealed (with RTV com- 
pounds) for approximately one-third of the aircraft (around doors, galleys and lavatories), water will eventually 
seep through the joints, especially where panels are not properly re-sealed after periodic inspections. All un- 
sealed sections over the remaining two-thirds of the aircraft are assumed to leak immediately. Water would 
then run down into the lower lobe, but would leave some trapped between panels on top of the floor beams. 
This trapped moisture would become a significant corrosion concern if no cleanup or drying were effected. 

In addition to the water leaking through the floor, the proposed spraying of water directly into the overhead 
would result in runoff past and over die sidewall panels and into the insulation blankets, and stringers. 

Existing drain paths in the fuselage consist of %-inch dia drain holes spaced at regular intervals along the 
stringers, eventually zigzagging down to Vs-inch dia pressurized drain valves in the belly of the aircraft. These 
drain holes and valves are designed to remove condensation accumulations from the airplane. The valves are 
open on the ground when the airplane is depressurized. Following a water spray event, these drain paths 
could become clogged from dust and debris washed through with collected water spray, causing trapped water 
and a potential corrosion problem. This situation is certainly realistic from an operational point of view. Figures 
5.6-1 and 5.6-2 show dust and debris accumulations in the lower areas of a recent vintage 757. The “washing” 
effect that significant quantities of water would have on this type of accumulation would almost certainly result 
in trapped moisture, and clogged drain paths. Increased maintenance to eliminate this type of build-up might 
be necessary. 
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Figure 5.6-1. 757 Lower Lobe Dust Accumulations. 
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Figure 5 6-2. 75 7 Lower Lobe Dust Accumulations . 


5. 6.2.2 Doors 

No potential structural or mechanical problems due to water are anticipated on the aircraft doors, since they 
are self contained and are not part of the stringer flow system previously described. Little water would enter 
the door structure through the internal liner or slide bustle cover, as these items provide a continuous cover 
over the inner door structure. Any stray water that did penetrate would be able to drain straight through and 
exit the bottom of the door. Water spray has not been considered to pose any significant threat to the aircraft’s 
doors or door structure latching mechanisms. 

Initially, some concern was expressed over the effects of water on the door mechanism. Freezing of condensa- 
tion in the bottom of the lower gate has been a concern in the past, with difficulties opening the door after 
extended flights being reported. The additional water expected to drain into the vicinity of the escape slide girt 
bar from the passenger cabin following water spray could add to this problem. However, as demonstrated by 
the earlier reports, the emergency' operation of the doors would not be affected. 

5.6.3 Return to Service 

In order to minimize long term corrosion effects to the airplane structure, any reconditioning program should 
begin immediately following the water spray event. Tire interior should be stripped, including all insulation 
blankets and floor panels, and the fuselage interior dried and inspected for clogged drain holes. The CIC appli- 
cation should be inspected and, if necessary, re-applied. The tops of the floor beams should also be inspected, 
and special attention paid to any areas that might collect water. The drain valves in the belly of the airplane 
will require inspection for clogging, and replacement as required. These valves (twenty-nine on a 757) are 
readily accessible from the outside of the airplane. The magnitude of the reconditioning process might be 
minimized by taking advantage of the “down” time and performing a complete “D” check at that time. 
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5.6.4 Mitigation of Disbenefits 


Given current aircraft staictural design and construction, there are no simple methods by which the 
disbenefits associated with the inadvertent activation of a water spray system might be eliminated, or even 
minimized. The effects of water will be insidious; it will migrate to wherever it’s not wanted. Some consider- 
ation should be given, on new designs, to construction methods that will further minimize potential water 
traps. A more realistic recommendation would be to improve maintenance to ensure that debris accumulations, 
similar to those shown in Figures 5.6-1 and 5.6-2, are not present, allowing the existing drain paths to function 
as designed. This would certainly result in greatly increased maintenance costs to the aircraft operators, but 
might be the only reasonable alternative to significant changes to current design should a water spray system 
be implemented. 

5.7 HUMAN FACTORS 

The Human Factors aspects of cabin water spray discharge, both in the intentional and unintentional cases, 
were reviewed for potential disbenefits. Unlike quantifiable analyses reported elsewhere in this document, 
there is very little objective data that can be used to evaluate the impact of water spray on passenger behavior 
aloft or on the ground. Human factors considered everything of a behavioral, physiological, medical and psy- 
chological nature relevant to this concept. This section then, includes a great deal of speculation based on 
professional experience, and projections based on a review of the scientific and anecdotal literature of actual 
emergencies/accidents for clues as to the probable behavior in such situations. 

5.7.1 Introduction 

The installation of a cabin water spray system in a commercial jet aircraft is intended to provide additional 
evacuation time for the passengers, delay the combustion of cabin materials, and thus the toxic products of 
combustion, in the event of an external fire situation. Inadvertent activation of a water spray system, whether 
inflight or on the ground, poses potentially serious consequences to passengers and crew. A “wony list” of 
human factors concerns in the event of water spray deployment is presented in this document. This list is not 
necessarily complete and it is certainly speculative; most of these factors cannot be objectively quantified. 
Among the factors we have identified as of most concern are: 

• Environmental conditions, which may cause slips, falls, obscured vision, etc. These items must also 
be considered in the inadvertent activation case, with the potential for injury they introduce. 

• Potential for inhalation of water droplets after the “wasUng” effect has caused them to absorb the 
constituents of toxic gases, and the effect this will cause when taken straight into the lungs 
(Reference 3). 

• Physiological stress, such as hypothermia and physical exertion, which may be too high for debili- 
tated passengers if forced to evacuate in a cold climate. 

• Disease caused postflight by environmental conditions and/or organisms which could proliferate in 
stored water. (The same microorganisms have potential for causing fouling and corrosion of the 
storage/distribution system). 

• Psychological stress culminating in collapse, fainting, undesirable behavior or even medical 
conditions in susceptible individuals (e.g., heart attacks), if confronted with an inadvertent 
discharge inflight. 

• Behavior of people upon activation of a water spray system. Will this system create a “panic” situa- 
tion following inadvertent or ill-advised precautionaiy use, causing injuries where there should have 
been none? 
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57.2 


Assumptions 


By contractual agreement, only disbenefits of a cabin water spray system were considered. The study deals 
with a concept, not a system, since no operational hardware has been developed to date for inflight use. This 
was, by definition, a paper analysis only — no inflight or laboratory testing was authorized. 

57.3 Consequences of Water Spray Activation 

57.3.1 Evacuation in Emergency Situations 

When considering the addition of a cabin water spray system to a commercial aircraft, there are two design 
requirements to consider: the effect that the water spray will have with inadvertent activation, and the resultant 
exit of the aircraft, and, the effect on an evacuation in a real fire emergency. 

Many “precautionary” evacuations of commercial aircraft take place on a yearly basis. Cabin smoke, engine 
fires and other incidents dictate a cautious approach to passenger safety, which often means treating the inci- 
dent as potentially life threatening, and exiting the aircraft as quickly as possible, often by the escape slides. 
There is a potential for injury in these evacuations, but it is considered an acceptable risk, since, in most cases 
they are purely precautionary, and take place in close to ideal conditions. 

The wetting of the cabin interior by a cabin water spray system, however, adds a new element to this type of 
evacuation. Slippery 7 conditions, as might be expected following water spray, will likely increase evacuation 
time. Leather soled shoes and other types of footwear may be especially susceptible to slipping on wet carpet. 
Since it is entirely likely it could be impossible to “disassociate” a water spray discharge from a fire emergency 
in the minds of the passengers, the pushing, shoving and crowding at the exits, combined with slippery condi- 
tions, might well increase the injury potential over what might currently be expected. Reduced vision, both 
from the water spray itself making emergency lighting difficult to see, and from the potential of wet eyeglasses, 
is another factor that will tend to slow down any evacuation. When combined with the potential for at least 
partial loss of lighting and passenger address systems, as might be expected from water damage (Section 5.3), 
a “precautionary” evacuation takes on a new level of passenger risk. This results in a negative safety gain over 
current aircraft configurations, and must be considered in any net safety benefit analysis. 

In the case of the actual fire emergency, all of the above listed concerns are still appropriate, with one signifi- 
cant difference. All these factors may slow the evacuation process, which, in this case, could result in a greater 
loss of life (information from literature related to emergency evacuation is located in Appendix E). 

57.3.2 Physiological and Medical Consequences of Water Spray Actuation 

Reduced internal body temperature (hypothermia) can potentially occur under a wide variety of circumstances, 
both inflight and on the ground. Hypothermia is a likely consequence of use of a cabin water spray system, 
even if the system is activated on purpose when ambient conditions are cold. If the outside ground environ- 
ment following evacuation is very cold, the shivering and high metabolic load imposed by hypothermia can 
lead to collapse, syncope, inaction, and, if persistent, death. Aged and infirm people may have inadequate or 
non-functional thermoregulatory reflexes. Reduced internal body core temperature is most likely to occur from 
cold outside air temperature, ambient wind chill, and inadequate clothing, but may also occur with substance 
abuse (alcohol, illicit drags), fatigue, fear and other forms of debility. Obviously, soaking/wetting by the water 
spray system will aggravate the cold injury problem (Reference 4 and 5). 

Cold injury is more rapid when convection is high as in cold conditions with a stiff wind. This carries heat 
away from the body more rapidly than in calm conditions and can rapidly lead to the signs and symptoms of 
hypothermia, including frostbite, frostnip, chilblains, etc. The well-known, readily available Sipple wind chill 
chait quantitates the physiological effects of temperature versus wind speed. 
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Disease is defined as aberrations to the internal environment (homeostasis) of an individual, i.e., deviation 
from health. An unplanned water spray event could trigger a variety of immediate and long term effects on 
passengers. Immediate psychological stress could lead to medical emeigencies such as myocardial infarction 
(heart attacks), collapse and/or vasovagal syncope (fainting), etc. Post-flight effects of unwanted water spray 
might include colds, flu, pneumonia, etc., developing after an appropriate incubation period (depending on 
the organism and host resistance) after exposure to the stressful, cold, damp conditions water spray might 
provide. Healthy people may miss time from work, etc., whereas infirm people may contract potentially life- 
threatening disease. 

The long term storage of water aboard the aircraft that water spray might demand creates additional concerns. 
Microorganisms growing in a stored water supply and/or in the distribution system could transmit disease if 
sprayed on people. For example, Legionnelia p . (bacterium which causes Legionnaire’s disease) has been 
reported in the humidifier reservoirs of some aircraft. Colonies of bacteria will grow in enclosed water storage 
systems, especially when the water is not circulated or replenished. 

Biofilm growth poses potentially serious corrosion risks to the storage tanks which in turn could adversely 
affect personnel. Choice of materials for storage and distribution of water must include evaluation of the 
potential for microbial influenced corrosion and contamination (Reference 6 and 7). Various biocidal agents 
may prevent or at least delay this problem but may in themselves prove toxic to humans and/or corrosive to 
materials. This may necessitate frequent system water change-outs and/or sampling of the stored water for 
the presence of microoiganisms. Microbial biofilms have the following potential consequences in a water- 
storage system: 

• Disease in susceptible people (pathogenesis); 

• Corrosion of containers, pipes, spray jets, etc., and; 

• Fouling of the system. 

Microbial films are known to thrive even in nutrient-deficient “pure water” in metal containers(Reference 8). 
Some species are resistant to biocides such as iodine and become more resistant with time to biocides 
(Reference 9). 

Given the modern aircraft cabin, the possibility of electric shock is something which should not be overlooked. 
Severity of symptoms depends upon many factors including type of current (ac/dc), level, grounding, duration 
of exposure, physical conditions of human, etc. Its effects include startle, muscle spasms, muscle contraction 
leading sometimes to fractures or dislocations, respiratory paralysis, cardiac arrest, and loss of consciousness. 
Severe levels of electric shock, although not likely here, can cause death, especially in debilitated people 
(Reference 10). 

5.73.3 Psychological Aspects of Emergency Evacuation 

Hysteria can be caused by real or imagined life-threatening situations such as could occur in inadvertent water 
spray activation. Hysteria can be precipitated by feelings of helplessness, what-to-do feelings, and claustropho- 
bia from the rapidly changing cabin environment brought on by the sudden suige of water. False alarm 
emergencies have caused passengers in some aircraft to initiate evacuation when not specifically directed by 
the flight crew (Section 5 8. 1.3). The severity of this reaction could be lessened by strong leadership on the part 
of the flight crew and/or passengers. It could be worse in, for example, a night inflight activation situation 
when the lighting system fails. Water spray jets may also cause a high-frequency, high-decibel sound which 
could cause the startle reaction, disorientation and possibly temporary hearing shift (deafness). 
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5.7.4 


Mitigation of Disbenefits 


If a cabin water spray system to suppress fire flashover is to be installed in commercial airliners the following 
human factors should be considered: 

• Assure augmented and thorough training for flight attendant and [light deck crew (Section 5.8) 
as follows: 

— “Crowd control” training to prevent panic and hysterical reactions when the system is used inten- 
tionally or inadvertently; 


- Realistic training and personally experienced effects of water spray system deployment; 

- Complete knowledge of the cabin water spray system; 

- Frequent refresher training re: cabin water spray system (frequency 7 period - TBD); 

• Prevent micro- fouling by microorganisms in the storage and distribution systems through use of 
frequent sample analyses, selection of appropriate biocidal agents, and maintenance/replenishment 
of water; 

• Consider type of materials for fabrication of the storage/ distribution system regarding biofilm 
growth, corrosion, resistance to biocides, etc.; 

• Consider source of water when replenishing water in storage tanks. In some parts of the world 
local water supplies may be so contaminated as to be not suitable for this puipose (or the potable 
water and humidifier reservoir). 

5.7.5 Summary 

A cabin water spray system is, by design, a safety enhancement for the protection of the aircraft's occupants in 
a [ire situation. It is a human factors solution to the problem of fatalities due to a serious external fire scenario, 
and alfords passive protection during the critical few moments of evacuation. 

There are, however, some serious deficiencies in the work done to date in support of this system, and its effect 
on the occupants it is designed to protect. Any slowing of the evacuation process in a fire emergency, for 
reasons described in this section, will result in a system that is less valuable to the aircraft’s occupants than the 
net safety benefit analysis claims it to be. 

Concerns exist for the non-fire situation also. No component is 100% reliable, as evidenced by the redundancy 
required of all components critical to flight. As presented here, an inadvertent deployment of a cabin water 
spray system can cause serious problems for passengers. Hypothermia, post-flight disease from contaminated 
water, and the psychological stress from the unexpected discharge of water all demand attention and study to 
determine and quantify the effects on both the passengers and the net safety benefit analysis. As the CAA 
concluded when considering the use of passenger smokehoods (Reference 2), the addition of a safety system 
that may cause more fatalities than the system's ability to save is unacceptable. All factors must be investigated 
and tested to ensure that this is not also the case with cabin water spray. 

There is a tendency to overlook the negative aspects of a system in the conceptual stages of design when early 
testing shows promise. Tliis study was contracted for the purpose of exposing any “disbenefits” that a cabin 
water spray system creates that the controlled laboratory testing did not consider. As outlined, substantial hu- 
man factors questions must be answered before this system is able to claim a positive net safety lxmefit. 
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5.8 


FLIGHT DECK OPERATIONS 


The determination of disbenefits in flight deck (and cabin) operations and procedures due to a cabin water 
spray system is a problematical endeavor at best. This is based upon the fact that: 1) there is no complete 
system design available for analysis, testing, and evaluation; and 2) there has not been extensive testing of 
the effects of cabin water spray on the avionics and other systems of a functional commercial aircraft. In this 
regard, conjecture or paper analysis of the likely effects simply is not sufficient to form a basis for the determi- 
nation of the “fly-ability” of the subject aircraft. Until such tests are performed, the conclusions of this, and any 
other analytical review of the area, should be considered as hypotheses. 

5.8.1 Inadvertent Activation 

Inadvertent activation during flight is one of the most important, and potentially dangerous, scenarios foi a 
cabin water spray system. The CWS system that has been proposed as the baseline for this study is not intend- 
ed, nor designed, for use in fighting inflight fires. In view of the potential consequences if a cabin water spray 
system is activated inflight, there must be “fail, locked out” protection against inadvertent activation while air- 
borne. The probability that this level of protection would fail and result in an inadvertent activation of the CWS 
system must, in combination with the probability that activation of the CWS system would cause failure of any 
critical components or systems, be no more than 10' 9 in order to meet FAA requirements for protection against 
catastrophic failures. 

5.8. 1.1 Aircraft Diversion 

Inadvertent activation of a cabin water system while the aircraft is inflight will most likely result in a diversion 
to a suitable alternate airport unless the destination airport is closer. The rationale for this is twofold: 

• Even though it may be shown that there is only a small probability that the water/moisture from a 
CWS activation would cause failure of any flight-critical components or instrumentation, it is very 
likely that standard procedures for dealing with such an event would call for a flight diversion to 
the nearest airport. This view is based upon the potential catastrophic outcome of any common 
cause failure of redundant components, and given that the probability of such an occurrence would 
increase over time; 

• It may be difficult, if not impossible, to determine immediately what caused the inadvertent activa- 
tion. There would probably be at least an initial tendency of the passengers to believe that a fire 
had broken out. Even if the cabin crew can dissuade them of this fear, it is likely that the passen- 
gers will be anxious to get on the ground as quickly as possible, given their somewhat damp 
condition after exposure to the CWS system. 

5.8. 1.2 Loss of Flight Instruments 

While loss of any flight instruments might be considered to be a disbenefit, it is the potential for loss of flight- 
critical instruments that is of serious concern. The analysis reported in Section 53 suggests that there is a low 
probability that any flight instruments will fail with a single activation of the CWS system. It should be noted, 
that while the probability of significant amounts of moisture reaching the E/E bay may be quite low, the FAR 
requirement for the reliability of flight-critical component functions is one-in-a-billion, or 10' 9 . 

In current designs, this level of reliability is reached by designs in which triple redundancy of many of the 
components reduces the probability of multiple failures of these redundant components to extremely low 
levels, assuming there is no basis for a common-cause fail ure source (Section 5.9). Cabin water spray systems 
appear to introduce such a source into the failure equation. It could certainly be hypothesized that if a mois- 
ture source resulting from activation of the CWS system acted to fail a certain component, it would have a fairly 


48 



high probability of similarly affecting adjacent or nearby components that are identical or of similar constaic- 
tion. In many cases, redundant components are positioned side-by-side, or at least located in near proximity. It 
is certainly credible that the probability of multiple failures of redundant components could be quite high 
under this scenario, assuming the initial failure takes place. 

An example of this occurred in October of 1988 to the crew of a two-engine medium-large transport. Quoting 
from the crew’s report: 

“Just after lift-off (from Yakutat, Alaska), the fire bell sounded and all three fire lights 
(engines No. 1 and No. 2 and APU) illuminated. Ceilings were variable 600' to 1500' 
with visibility 2!/ miles in fog and rain and a 10-15 knot wind out of the northeast. We 
immediately turned downwind, remaining in VMC, and landed uneventfully. The prob- 
lem proved to be rainwater entering various control electronics boxes in the E/E bay. 

The water most likely entered through the forward entries and main cargo door area 
during mrnarounds at stations where it was raining. The water seeps into the smoke 
vent/grille in the forward galley area and then down to the electronics bay. Water accu- 
mulates in a drain pan especially designed for isolating water intruding into the E/E bay, 
but the drains were plugged with dirt and debris, allowing the drain pan to fill (and 
overflow at aircraft rotation).” 


This was a case where three like components failed due to a common-cause invasion of moisture into die E/E 
bay. Fortunately, the items that failed were not flight-critical. It is worth noting that even these failures caused 
an immediate turn-back to the airport. 

5.8. 1.3 Flight Crew Operations 

The inadvertent activation of the CWS system while in either the takeoff or landing phases of flight would 
be the most important, and potentially the most disastrous, type of inadvertent activation, due to the high 
workload and critical timing of the takeoff or landing procedures. Any disruption or distraction from these 
procedures might result in serious, if not disastrous, consequences for the flight crew, the passengers, and the 
aircraft itself. 

Because of the potential consequences of such distractions, many of the aircraft systems’ caution and warning 
indications are inhibited during these phases of flight. Thus, even with fairly severe system failures, the flight 
crew is protected from the intrusion of the alerting indications of these failures during the critical segments of 
either a takeoff or landing. Only those failures which might affect the decision to continue or abort a takeoff or 
landing are presented to the flight crew. 

Of paramount importance during these phases of flight would be the protection against the inadvertent activa- 
tion of the CWS system. These phases are also the most difficult to provide with this protection, since the 
system must be “armed” at these times. As with the inflight phase, the design of the system must protect 
against inadvertent discharge to a probability of 10 9 It will most likely require extensive simulator testing to 
determine what the procedural effects of a CWS activation during takeoff or landing would be. 

An inadvertent activation of the CWS system would probably be dealt with in the same manner as many other 
system faults, i.e., the system failure indication would be inhibited during these two phases of flight, consistent 
with how other indications are likewise inhibited. It is likely that the event itself would not escape the attention 
of the flight crew, regardless of whether an indication is presented on the flight deck. The release of water 
spray, and the resulting reactions of the passengers and cabin attendants, may be impossible to hide from die 
ciew. Thus, a very real threat to flight safety W'ould remain if activation distracts or disrupts the crew r during 
these critical phases. 
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Even an inadvertent activation of the CWS system on the ground poses some rather difficult decisions for the 
flight crew and cabin attendants. This stems from the fact that activation on the ground is an acceptable mode 
of operation, assuming there is a fire. The problem is one of determining whether the activation is due to a 
legitimate cause (fire) or is an inadvertent activation. This might not be so difficult if one could assume that 
some type of collision or other impact or obvious event would always be precedent to a fire event that would 
activate the system. Two decisions or duties resulting from the incorporation of cabin water spray are: 

5.8. 1.31 Decision to Evacuate 

If it cannot be determined reliably that a “valid” fire condition does not exist, the activation would have to be 
treated as a legitimate event. Basically, this means the orderly evacuation of the passengers from the aircraft. 
This, in itself, must be considered a disbenefit if the cause is a “non-event”, because evacuations very often 
result in injuries to passengers (Section 5.7). 

Sometimes, the decision to evacuate can be taken out of the hands of the cabin attendants or crew. The fol- 
lowing incident also illustrates the occasional panic that may be exhibited by some passengers in situations that 
may appear to be life-threatening, but are actually quite benign. Quoting Neil Santaniello of the Fort Lauder- 
dale News and Sun-Sentinel, as reported in the Seattle Times (September 11, 1990): 

“The first shout of “fire” came from a passenger sitting by the right wing of the Boeing 
727, shortly after TWA flight 194 from Fort Lauderdale, Florida, touched down at New 
York's LaGuardia airport. Other passengers quickly joined in, yelling and pointing to 
flames shooting from an auxiliary power unit on the wing as the aircraft taxied toward 
the terminal Sunday night. 

What happened next caught everyone by surprise: panicked passengers flung open 
emergency exits and bailed out. A few jumped from a wing onto the tarmac while the 
plane was moving, said passenger Lauren Rubel, 44, a New Yorker with a home west of 
Boca Raton, Florida . . . “everybody started to scream. Everybody went crazy,” said 
another passenger, John Fontana, 60, . . . passengers said the captain left the cockpit 
briefly to tell passengers to sit down and not to panic. But “the people didn’t give a 
damn anymore,” Fontana said. 

TWA officials called the evacuation an overreaction on the part of the passengers. The 
flames came from an auxiliary power unit that backfired, they said. “The passengers 
thought there was a fire, and they overreacted,” TWA spokesman Jim Faulkner said from 
St. Louis. “The captain did try to communicate to them it was not a fire, but they had 
already headed for the doors.” ... A wave of “organized panic’ then took over as other 
passengers left the plane, most of them sliding down four emergency chutes that were 
deployed. At least three passengers were injured.” 

5.8.1. 3-2 Deactivation or Shut-off of CWS 

If it can be determined immediately that the activation is inadvertent and unnecessary, provisions might be 
provided to manually shut-off the CWSS before it has completely exhausted itself. This would reduce passen- 
ger irritation and also reduce the cost of returning the aircraft to service. 

5.8. 1.4 Cabin Attendant Operations 

Although there will be some routine activities required of the cabin attendants in case of an inflight activation 
of the CWS system, the potentially most demanding action will be to control the reactions of the passengers to 
the spray, to minimize behavior which might be disruptive or pose a threat to other passengers, the flight 
attendants, or the flight itself (Section 5.7). To the extent that an inadvertent activation of the CWS system dis- 
rupts the duties of the flight attendants, it would be considered a disbenefit to normal flight operations. The 
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degree of disbenefit would correspond to the seriousness or criticality of the procedures or functions that are 
disrupted by the CWS event. Most flight attendant functions are directed towards passenger comfort rather than 
safety-of-flight. Such disruptions would usually be at a much lower level of criticality than that affecting the 
flight crew. 

Communications problems might be considered disbenefits of an inadvertent activation. A direct impact would 
result from failure of intercom or communications systems by water ingress from sysrem discharge. The disben- 
efit would stem from the resulting increase in time and effort for the cabin crew to communicate with either 
the flight crew or with the passengers. An indirect communication disbenefit might result from the increased 
difficulty in all types of communications due to confusion following a system discharge. This could vary from a 
minor annoyance to a fairly serious disruption of normal communications. The last type of communications 
disbenefit is perhaps more hypothetical, but could be expected to occur with at least a small percentage of the 
flight attendants. This would be a consequent over communication with the flight crew in the aftermath of a 
CWS S event. Since the event is unexpected, and because the cabin attendants may not be prepared either 
procedurally or psychologically for dealing with such an event, it is likely that some attendants would fall back 
on the flight crew to provide guidance and instaictions on subsequent actions. While this would affect the 
actions and effectiveness of the cabin attendants, the more serious disbenefit would likely be to the flight crew 
who is distracted and interrupted by the calls from the cabin attendant(s). 

5.8.2 Commanded Activation 

“Commanded activation” means the CWS system has been intentionally activated for its designed purpose. This 
activation could be either via an automatic system which senses the conditions that are necessary and sufficient 
to activate the system and then acts through pneumatics, electronics, hydraulics, or a combination thereof to 
activate the system, or it could be through the manual activation of the system by the flight crew, or perhaps 
by the cabin attendants. The pros and cons of these various types of activation methods, and their potential 
disbenefit effects on crew operations and cabin attendant procedures, are discussed in the following section. 

5.8.2. 1 Flight Crew Operations 

Disbenefits to the flight crew will be dependent upon the arming/activation/operation scheme that is chosen. 
Various manual and automatic sequences have been suggested, but it is clear that the least disbenefits to the 
flight crew will come from the system that requires the least action on their part. It is inappropriate to comment 
on the various sequences that have been mentioned to date other than to reiterate that operation of any poten- 
tial system must be fool-proof, working as intended only when intended, and invisible to the flight crew. 

The success of a post-crash or fire event evacuation might depend upon successful communications between 
the flight deck and cabin crew. At the least, the evacuation could be delayed somewhat by any breakdown in 
communications due to water effects, as outlined earlier in this report. While many things might cause such a 
disruption, including CWSS activation, it is impossible to estimate its role without extensive testing in a func- 
tional aircraft. Even if communications are disarpted due to CWSS contamination, the disbenefit effect is likely 
to be on the order of only a few seconds of delay before the crew discover that they cannot communicate with 
each other. This would be a disbenefit only in the less destructive cases, where the airplane is left basically 
intact. In more extreme cases, the flight attendants may not wait for an evacuation command from the flight 
deck, nor attempt to communicate with the crew prior to initiating a passenger evacuation. Thus, this type of 
disbenefit should be considered of minimal importance. 

5.8.3 Testing Requirements for Determination of Crew/Cabin Disbenefits 

Many of the potential disbenefits to crew or cabin operations or flight integrity can only be ascertained by 
extensive testing of the effects of CWS on avionics components and other airplane systems in a fully functional 
aircraft. Some tests might be done at the component level to determine susceptibilities, and to isolate the pri- 
mary drivers that might result in significant disbenefits. These tests would include such things as susceptibility 
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of various LRUs to moisture (in various forms) and pathway tests to determine where tire water is likely to run 
under various configurations and airplane attitudes. 

It would be useful to look for both immediate and long-term effects of moisture contamination on avionics 
since the latter could have significant return-to-service impact, or, if not reconditioned (dried out and repaired), 
might result in serious future failures of these components. 

In order to detennine the probability of various avionics failures, and what effects these might have on control- 
lability of the aircraft, tests need to be performed which involve a fully functional avionics suite, with the ability 
to simulate various airplane attitudes. 

Testing of the type described above can detennine, to some extent, the likelihood of various avionics compo- 
nents or systems failures and false indications after the CWS system has been activated. There is no known 
comparable test that could determine what tire behavior of passengers, attendants, and crew would be after 
such an event. The best indicators are tire actual behaviors exhibited in similar situations. To the extent that a 
CWS event emulates some or many of these historical events, some relevant indications might be gathered 
from these past events. In addition, a “mock-vanilla” evacuation test might be run in which a CWS system was 
used without prior warning of the participants. Tests of this type are currently being considered by the CAA 
and the Cranfield Institue in the UK and may shed some light on the question of passenger behavior after an 
inadvertent activation of the system. 

5.8.4 Mitigation of Disbenefits 

A reduction in the disbenefits of cabin water spray from the flight deck operations perspective may be 
achieved with the following steps. First, flight and cabin crews must be given thorough training in the ratio- 
nale, the operation, and the benefits of cabin water spray. Re-training at appropriate intervals must also be 
considered, since, in all likelihood, many crews will never see a situation requiring it’s use, nor will they expe- 
rience an inadvertent activation. Second, flight deck operations, to assure the continued safe flight and landing 
of the airplane, even after inflight activation of the system, cannot be compromised. This dictates that essential 
airplane systems and controls must work, with whatever changes for “water hardening” of components and 
systems being designed and implemented. This also means, that the flight deck crew must not be burdened by 
activities outside the flight deck while control of the airplane is paramount, which leaves the cabin crew to 
attend to whatever situation the water spray has caused there, including control of the passengers under what 
might be very unpleasant conditions. Lastly, consideration should be given to what, if any, briefing is given 
passengers on the water spray system, including what to expect if the system goes off, and to rely on the direc- 
tion of the cabin crew for their next step. 

5.9 PRODUCT SAFETY 

5.9.1 Introduction 

Aircraft safety systems are designed to be independent from other aircraft systems, and to not adversely affect 
die operation of other systems or the airplane. Older technology aircraft are more mechanical and less elec- 
tronically sophisticated. Systems were independent and were monitored by the crew, with interface accom- 
plished by means of manual controls. More recent aircraft have sophisticated interfaces between systems that 
monitor and control functions without human input, and at very high speeds. The discharge of a cabin water 
spray system into this sophisticated electronic environment could, without significant upgrades to other systems 
and components, introduce a potential for complex systems malfunction that would jeopardize the continued 
safe flight of the aircraft, and put its passengers at an unacceptable level of risk. The following sections de- 
scribe the anticipated disbenefits and effects on aircraft safety systems and philosophy. 
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5.9.2 


Common Cause Failure 


The commanded or inadvertent activation of a cabin water spray system introduces a potential “common 
cause” mode of failure for which all systems and components must be evaluated. Current system architecture 
allows primary and secondary LRUs for many systems to be co-located (Figure 5.9-1 and 5.9-2). Rationale for 
this has always been that both units would not be at risk from the same threat. However, the presence of 
water, and the uncertainties of the water paths which would result after discharge, introduces a potential for 
both units to be damaged by the same flow of water at the same time, since their original location selections 
were not made considering tliis type of threat. Tliis is defined as the possibility of common cause failure. The 
potential for common cause failures, and their implications on the safety of the aircraft and its occupants, dic- 
tate they be made a highly improbable event (< 1 x 10 9 ) through increased component protection against the 
threat of moisture, and through isolation of redundant components by both location separation and increased 
compaitmentalization. Additional measures would include an enhancement of the moisture protection of cur- 
rent designs, decreasing the probability of moisture reaching critical components by increasing the moisture 
absorption capability of the air-conditioning system, cabin carpets, drain tracks, drip pans, etc. The many sce- 
narios for multiple failures and the separation requirements to prevent them will not be addressed in this study, 
since any serious consideration of the adoption of cabin water spray must address this problem on a more 
global basis, designing the layout of critical equipment accordingly. 
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Figure 5-9-1. 7 67 Front View Main Electrical/Electronic Racks. 
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Figure 5.9-2. 7 67 Front View Main Electrical/Electronic Racks. 


5.9.3 Safety-of-Flight Critical Equipment 

Since a cabin water spray system could affect multiple systems concurrently (Section 5.9.2), research %vas con- 
ducted to determine which equipment on current aircraft is critical for continued safe flight and landing. 
AC 25. 1309-1 A states the following criteria for continued safe flight and landing: 


“The capability for continued controlled flight and landing at a suitable airport, possibly 
using emergency procedures, but without requiring exceptional pilot skill or strength. 
Some airplane damage may be associated with a failure condition, during flight or upon 
landing.” 


Research involved identifying the systems and equipment that the flight crew would need without requiring 
exceptional skills. In order to accomplish this, failure conditions and their severity classifications were re- 
viewed. According to AC 25. 1309-1 A, a failure condition is: 


“The effects on die airplane and its occupants, both direct and consequential, caused or 
contributed to by one or more failures, considering relevant operational or environmen- 
tal conditions. ” 
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The failure condition severity classifications are: 


- Failure conditions which would not significantly reduce airplane safety, and which 
involve crew actions that are w 7 ell within their capabilities. Minor failure conditions 
may include, for example, a slight reduction in safety margins or functional capa- 
bilities, a slight increase in crew 7 workload, such as routine flight plan changes, or 
some inconvenience to occupants. 

- Failure conditions which would reduce the capability of the airplane or the ability 
of the crew to cope with adverse operating conditions to the extent that there 
would be, for example, — 

- A significant reduction in safety margins or functional capabilities, a significant 
increase in crew w r orkload or in conditions impairing crew 7 efficiency 7 , or some 
discomfort to occupants; or 

- In more severe cases, a large reduction in safety margins or functional 
capabilities, higher workload or physical distress such that the crew could 
not be relied on to perform its tasks accurately or completely, or adverse effects 
on occupants. 

Catastrophic - Failure condition which would prevent continued safe flight and landing. 

The complete failure of the electrical system is considered to be a major failure in our current aircraft designs. 

In order to prevent a catastrophic failure, and compromise continued safe flight and landing, the functionality 
provided by the standby power system and the equipment powdered by this system is required to remain 
operational. This level of criticality must be maintained after inflight discharge of a cabin w^ater spray system. 

'Fables identifying the equipment currently powdered by the standby powder systems of the 737, 747-400, 757, 
and 767 airplanes are included in Appendix B. These tables outline the minimum required functionality of the 
electrical power systems for continued safe flight and landing, and help define the equipment which must be 
“hardened” to assure that failure which might result from a cabin w r ater spray discharge is a “highly improba- 
ble” (< 1 x 10 ‘0 event. This equipment is not currently designed or located considering the threat posed by a 
water spray system. 

5.9.4 Discharge Consequences 

For obvious reasons, the w'orst case for an unintentional discharge of a cabin water spray system is during 
takeoff, cruise, or landing. Cruise implies that the aircraft could be a significant distance from a suitable airport, 
should a system failure require the aircraft be landed at the first opportunity. The takeoff and landing phases of 
flight produce the highest crew 7 workload, and are the least tolerant of unnecessary distractions or incorrect 
information to the flight crew. Any incorrect or improper signals or system failures, or combinations of both, 
can have serious repercussions. 

The 1989 Kegworth crash of a British Midlands 737 might be used as an example. An engine failure on this 
airplane, follow ed by the inability of the crew to recognize which engine had failed, resulted in a fatal acci- 
dent. Section 5.4 indicates that water ingress into the EEC channel select and fuel shut-off circuitry 7 could, in its 
worst case, result in a main engine reverting to idle thrust. Elsewhere, in Section 5.3, the predicted results of 
water ingress into various other electronic components are incorrect and sporadic cockpit indications. These 
two conditions, while unlikely, illustrate the threat to sophisticated electronics posed by w<ater w 7 hen elaborate 
protective measures are not included. The extrapolation to a compromise of the safety of the airplane and its 
occupants is not unreasonable. 


Minor 


Major 
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5.9.5 Mitigation of Disbenefits 

In order to assure an equivalent level of safety with the introduction of a cabin water spray system, a number 
of significant changes to aircraft design would be required. As mentioned in other sections of this report, the 
incorporation of such a system would require the reevaluation of all other critical systems in the airplane in 
view of the threat that water poses. 

Current layout of critical system components in the electronics bays would need to be revised to eliminate 
common cause failure potential. This might mean redistribution of LRUs and/or water hardening of all equip- 
ment and connectors to eliminate the danger of electrical shorts and equipment compromise. An alternate 
approach might be to redesign the environmental control system such that moisture laden air flow to the elec- 
tronics bays is stopped upon initiation of water spray discharge. In any event, a comprehensive and rigoious 
testing program would have to be developed and imposed at the component supplier level to assure that 
whichever approach or combination is taken produces the necessary results. 

It is not the intent here to outline ail changes which might make the incorporation of cabin water spray suit- 
able for aircraft use. Rather, it is clear that any work in this direction must be undertaken at the global level, 
recognizing the environment that is created and in which other systems must continue to opeiate. 

5.9.6 Summary 

The introduction of a cabin water spray system is not a simple, add-on system. Water spray introduces major 
changes to the operating environment of the aircraft’s systems, and to the occupant s environment as well. 

While a water spray system can certainly be added to today’s sophisticated aircraft, from a technical perspec- 
tive, it must be done such that the CWSS achieves the goal of increasing passenger safety and not detracting 
from it. 

5.10 RELIABILITY AND MAINTAINABILITY (R&M) 

5.10.1 Introduction 

This study considered a concept, not a mature system, and no operational hardware has been developed to 
date for inflight use, therefore, only limited reliability analysis has been performed. Investigative work per- 
formed by R&M is of a very generic nature and describes what would be required during development of a 
cabin water spray system. R&M impact and program requirements would be different for existing in-design and 
production aircraft in relation to future design programs. While new design programs would be significantly 
impacted by including the CWSS, any retrofit programs would have a much larger R&M impact. 

5.10.2 Reliability 

5.10.2.1 New Designs 

A commercial jet aircraft is certified as die sum of its parts, in recognition of the fact that an anomaly in any of 
the systems in the aircraft can have a significant impact on other systems. From a design standpoint, any sys- 
tem to be incorporated into the aircraft is better identified sooner than later, since the analyses performed to 
satisfy the certification process are lengthy and dependent upon projected failure mechanisms, and the overall 
aircraft’s ability to tolerate a failure, while maintaining safety-of-flight. These analyses must cover both opera- 
tion of the water spray system, to assure it will work when required, and the potential impact to other systems 
in the aircraft, for all aircraft attitudes, in bodi commanded (systems required for safe evacuation must be pro- 
tected) and inadvertent (control of the aircraft, inflight and on the ground must be maintained) scenarios. The 
following is a basic listing, by no means complete, of the types of analyses which must be performed consider- 
ing the effects of a cabin water spray discharge: 
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• A comprehensive FMECA of all systems and components that would be affected by the CWSS; 

• Fault tree analysis of all systems and components that are considered critical. In addition, a higher 
level fault tree would be needed to determine if systems and components impact or interact in new 
ways not previously considered before the water spray concept; 

• MEL dispatch versus potential failure mode analysis of remaining systems. It cannot be assumed 
that all systems are 100% functional, and failure tolerant components, hidden failures, and inopera- 
tive or degraded components may no longer provide the required safety margins; 

• Degradation analysis; 

• Reliability tests and demonstration programs; 


• Potential sneak circuit analyses; 

• Reliability predictions; 

• Selected parts review. 

5.10.2.2 System Retrofit 


Assessing the impact of a CWS system on existing aircraft reliability is a difficult proposition. None of the sys- 
tems or components in current build aircraft were designed, specified, constructed or certified considering a 
potential water spray environment. In addition, since cabin water spray is presently only conceptual, and not 
designed or used on any aircraft in service, no existing data base for failure rates and in-service impact are 
available. We do know that a minimum reliability number is needed to provide the required degree of safety 
for all systems, especially safety-of- flight systems and components. There are over 50 critical systems requiring 
a 1 0‘' probability of failure, and at least as many essential systems requiring a 10 7 probability to be considered. 

In order to achieve this required level of reliability and analysis confidence, all components and systems that 
may be impacted by water spray will require re-analysis of all previously conducted fault trees, reliability analy- 
ses, specification requirements, MEL analyses, and safety analyses, which were used for certification. This in- 
cludes all those done by Boeing, as well as those done by the component subcontractors. For example, an 
analysis showing system redundancy, which allows dispatch with one component inoperative, may not allow 
dispatch with the introduction of a potential water spray system discharge. The additional fault introduced into 
the fault tree(s) and FMECAs may show that without system design changes there may be a criticality impact 
that would require a change to the MEL. Similar analyses for all components and systems may also show safety 
degradation requiring redesign and/or operating procedural changes. Here also, as with new designs outlined 
above, these analyses must cover both operation of the water spray system, to assure it will work when re- 
quired, and the potential impact to other systems in the aircraft, for all aircraft attitudes, in both commanded 
and inadvertent scenarios. 


5.10.3 Maintainability 

Given that this is a concept study only, with no proposed system design, only a listing of potential maintain- 
ability impacts are presented, and in general terms. The maintenance impact of some in-service water spills 
into the aircraft’s E/E bay and the passenger cabin have occurred and these can be evaluated for similarity to 
an inadvertent CWS discharge (Section 5.1.2). 

Additional information regarding inadvertent discharge cost and a detailed return to service analysis is also 
found in this report (Section 5.11). 
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Airline in-service water intrusion into the E/E bay due to water spills and lavatory overflows have resulted in 
the removal of electronic components, drying of racks and surrounding structure, application of water displace- 
ment agent, and reinstallation of replacement electronic components. Aircraft have required a check flight prior 
to return to revenue service. The removed components were returned to the over-haul shop for cleaning, test/ 
repair, and then put into spares. This airline procedure, for any accidental water spills that result in wet avion- 
ics in the E/E bay, would certainly be no different with an inadvertent CWSS discharge. 

The following is a partial list of studies and analyses that would be required for the incorporation of a cabin 
water spray system: 

• A reevaluation of existing maintainability analyses and studies for all systems and components that 
may be affected; 

• Maintenance tasks that will be required for safe ferry to an overhaul base from a remote station; 

• Maintenance impact of all interior furnishings and equipments that are changed - accessibility, 
manuals, training, procedures, checkout, etc.; 

• Inspections - changes, additions, when, where, tests and test equipment needed, how many 
mechanics, training requirements; for both the CWSS and changes to other systems and compo- 
nents, etc.; 

• Functional checkout procedure changes of redesigned systems and components; 

• Inspection and maintenance cost to the carrier; 

• Inadvertent discharge cost; 

• CWSS maintenance installation error probability; 

• CWSS component accessibility; 

• Potential incorrect servicing, installation, repair, testing of the CWSS; 

• Demonstration requirements to assure the system works in-service, after maintenance, aging fleet 
considerations, during certification, etc. 

Other topics that arise during design need to be considered, such as combi aircraft installation requirements. 
Further analysis will bring forth additional design and operational considerations that will have to be evaluated 
in addition to the above. 

5.10.4 Summary 

It cannot be over emphasized that the systems and components of in-service aircraft were not designed to be 
fault tolerant of water intrusion due to water spray system discharge. This potential was not included in specifi- 
cation requirements, fault tree analyses, system and component designs; not in any design consideration or 
concept. In order to ensure that any retrofit of these aircraft does not compromise safety-of-flight, this new 
system will require extensive testing to eliminate the potential of inadvertent discharge, and will also require a 
review of every conceivable and demonstrated water flow path throughout the aircraft, and the subsequent 
impact on all systems and components in the event of an inadvertent dischaige. It would require a review of 
not only relevant maintainability, reliability, and safety studies and analyses, but also a consideration of how a 
design might have evolved had the designer known that there was a possibility that water may be sprayed into 
the cabin. 
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5.11 


RETURN TO SERVICE 


The possibility of an inadvertent water spray activation, and it's consequences, have been discussed at length 
in many sections of this report. This previous discussion has addressed the subject from the functionality point 
of view, i.e., will the systems in the airplane continue to function and allow' continued safety-of-flight or unin- 
terrupted control in the taxi, takeoff, cruise, or landing phases of flight. This section will attempt to quantify the 
time and cost to return the aircraft to service following an inadvertent discharge. 

5.11.1 Assumptions 

Damage to the airplane is assumed to be limited to that caused by the water, with no collateral damage from 
external sources. This means the airplane has made a successful landing, and come to a safe stop with no loss- 
of-control. 

The process of refurbishing the airplane is assumed to begin immediately, thus not allowing corrosion to begin 
in places where water might be trapped. The “return to service” refurbishment assumes the aircraft is returned 
to iike-new” condition, since the unintentional discharge has occurred in a new airplane. The refurbishment 
process is assumed to take place at the aircraft’s maintenance base, minimizing any logistics issues that might 
require consideration if the aircraft is immobilized elsewhere. Costs to ferry an aircraft to its maintenance base 
could be substantial, but these costs, as well as the revenue lost while the aircraft is out of service, are not 
included in the refurbishment cost estimate. 

Finally, all estimates of refurbishment costs include only the time and materials required to repair and checkout 
the aircraft following the water spray event, and any parts requiring replacement are assumed to be immediate- 
ly available. No consideration has been given to incidental costs such as legal fees, passenger related expenses 
such as cleaning bills, damaged luggage, etc., or logistics costs which might be incurred after an aborted flight. 

5.11.2 Discussion 

The projected refurbishment of a 757 following water spray discharge was begun with a listing of equipment, 
systems and furnishings by ATA chapter. This listing of chapters and codes was reviewed by the appropriate 
Boeing functional organizations for expected damage from water, and formed the basis of the Delta Air Lines 
investigation. The ATA chapters and costs associated with refurbishment may be found in Appendix C. 

Upon identification of the components/systems expected to be wetted, whether directly or indirectly, each item 
was reviewed for the impact water is expected to have on that item. Although the quantity is not necessarily 
comparable, liquid spills on airplanes are not new, and lessons learned from those events have been used for 
this review. Where past experience has show r n that items exposed to water may be successfully cleaned, only 
labor for removal, cleaning, and re-installation are considered. A percentage of those items that are judged to 
be susceptible to permanent damage is assumed to require replacement, and material costs are added for those 
items. The Delta estimates are subjective, but represent a best guess estimate, based on operational experience 
and the evaluations made by the Boeing functional organizations, especially from an electrical/electronic sys- 
tems refurbishment standpoint. Those items which might impact the airlines’ image requirements, or where 
operational experience has demonstrated that diying and cleaning leaves a less than adequate appearance are 
assumed to be replaced, and full material costs quoted. Damage is considered to be “worst case”, and to have 
taken place on a new airplane, thus all reconditioning is done with the intent of bringing the airplane back to 
“like-new” condition immediately, for reasons stated in Section 5.11.1. 
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In order to return the airplane back to “like-new" condition following a spray event, the recommendations of 
the Boeing functional organizations have been followed. The interior of the airplane would be removed, in- 
cluding floor panels, to eliminate trapped moisture and prevent the start of corrosion. Insulation blankets 
would be removed, for the same reason, and the degree to which these blankets have been wetted will dictate 
their disposition. Seriously wetted or saturated blankets will be replaced, as Delta’s operational experience has 
shown that blankets which have been dried out do not perform the same as new ones. (Costs quoted in 
Appendix C are for complete blanket replacement, but this will be on an as required basis.) CICs would be re- 
applied at this stage, this being the best way to displace any remaining moisture from seams and joints, and 
ensure that the corrosion process is not allowed to begin. 

Delta’s experience with cleaning carpets and seat covers/cushions has shown shrinkage and impact on appear- 
ance to be severe enough that these items would require replacement, and are reflected in the cost estimates. 
Some relaxation might be possible here for an older airplane, but, as stated in Section 5.11.1, the incident is 
assumed to have taken place in a new airplane. All passenger cabin components are examined for water, and 
cleaned as required. Electrical items are dried and tested, with those that have shorted being replaced. General 
cabin illumination and passenger entertainment systems are considered vulnerable to failure from water ingress 
and short circuiting, and include material costs for replacing a percentage of the exposed units. These material 
costs are included in the Appendix C tables. (As an example, the 757 as configured for Delta Air Lines has 187 
passenger reading lights. Approximately V\ or 62, are assumed to fail due to water ingress, and must be re- 
placed.) Door bustle mounted slide packs, that are within the designated spray area, are also inspected for the 
presence of water. This inspection is performed only when the slide has not been deployed, and the tabulated 
costs reflect that inspection only. Slides that have been deployed after water spray activation would required 
re-packing at a cost of $1000 US per slide, with a total of 8 slides on the baseline 757. ECS equipment that has 
ingested water is inspected and dried as required. No material costs are expected for ECS equipment. 

The reconditioning of the E/E bay is based on recognition of the safety level of the components located there. 
Equipment located in the E/E bay is somewhat moisture resistant due to flight safety considerations. All rack 
mounted LRUs would be removed, dried, cleaned as required, and given a functional test. Based on input from 
the Electrical group in Section 5.3, no LRU failures requiring unit replacement are expected, therefore costs 
reflect the labor for removal, cleaning, test, and re-installation tasks only. As discussed in Section 5. 3-3.5, check- 
out and test in-place is not recommended. Moisture that is not eliminated can set-up destructive corrosion 
processes, as well as create a new malfunction situation when the aircraft assumes an attitude that causes 
droplets to collect at an undesired location, such as a terminal connection. 

The experiences of Delta, as well as of other carriers, indicate that a comprehensive and aggressive refurbish- 
ment program following water spray discharge is required to minimize long-term impact to the airplane, and 
shorter term degradation of current high levels of safety. This program will be expensive, however, attempts to 
delay or eliminate any part will likely result in a short term savings at the expense of greater long term mainte- 
nance costs. 

5.11.3 Summary 

Based on a labor rate of $50 US per hour, the estimated cost projection for returning a 757 to like new condi- 
tion following inadvertent system activation is $881,000 US. Breakdown by subject and ATA code is summa- 
rized in Table 5.11-1, while detailed backup documentation, as referenced above, is available in Appendix C. 
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Table 5.11-1. Labor/Cost Summary. 


Subject 

Labor 

Cost* 

ATA21 

143 mhr 

$ 7,150 

ATA23 

1 ,230 mhr 

142,400 

ATA25 

3,874 mhr 

508,140 

ATA33 

714 mhr 

133,800 

ATA35 

93 mhr 

4,650 

ATA51 

132 mhr 

7,300 

ATA53 

672 mhr 

33,690 

El rack 

26 mhr 

1,300 

E2 rack 

123 mhr 

6,175 

E3 rack 

117 mhr 

5,850 

E4 rack 

162 mhr 

8,125 

E5 rack 

117 mhr 

5,850 

E6 rack 

97 mhr 

4,875 

Panels 

250 mhr 

12,500 

Total 

7,750 mhr 

$881,800 

* Totals indue 

le material costs and labor rate 


of $50 US/hr 


From a maintenance perspective, the inadvertent discharge of a cabin water spray system will create a signifi- 
cant cost impact. While it is most likely not possible to mitigate the costs associated with a refurbishment after 
discharge, the incorporation of this type system would dictate a revised maintenance schedule philosophy. The 
level of disassembly required for refurbishment is similar to that required for a scheduled “D" check, and are 
similar in cost as well. If close to the regularly scheduled maintenance interval, the “D” check requirements 
should be satisfied at this time as well. If the incident occurs shortly after the last check, the complete refur- 
bishment will still have to be initiated, and the full cost burden to the airline will be realized. 

6. SUMMARY AND CONCLUSIONS 

Water spray systems, in the test scenarios conducted to date, have been effective in removing heat, and sup- 
pressing the generation of toxic smoke, by delaying the combustion of cabin furnishings. When examining the 
disbenefits created by the adoption of these water spray systems, one must keep in mind that the test vehicles 
used for the demonstrations of water spray technology are different in one very important respect from an 
operational aircraft so equipped; the operational aircraft must be able to provide continued safe flight and 
landing and must not be susceptible to any loss of control in the event of an inadvertent discharge, planned or 
unplanned, while on the ground or in the air. 

The objective of this study was to determine the disbenefits that may be created by the addition of a cabin 
water spray system to a commercial jet aircraft, and what precautions would be necessary to mitigate damage 
that would be incurred following both commanded and uncommanded discharge. It is difficult, as many of the 
functional groups participating in the subject study have pointed out, to predict the outcome of the deploy- 
ment of a system that exists only on papier and has not been fully designed nor tested in an aircraft. Water, 
containing ions and impurities, has demonstrated its corrosive and damaging effects in a multitude of in-service 
lavatory and galley spills. The very design and structural fabrication of an aircraft serve to trap and collect water 


6l 




where it is least desired. Structural junctions at frames and stringers, shear ties, floor beams and intercostals 
all become collection points for contaminated water, and sources of corrosion, leading to weakening of the 
structure. 

Modem commercial aircraft operate with very sophisticated electronic systems and controls. In evaluating the 
ramifications of electronic component and system failure that might result from moisture ingress, the individual 
functional engineering organizations have identified and described various situations that would be created by 
those failures. Moisture protection measures on existing aircraft are intended to minimize or eliminate the 
chance of failure in operational environments that include 100% humidity and visible moisture (condensation), 
but are not designed to prevent against the amounts of moisture that would be expected from a water spray 
discharge. Substantial protective measures that do not currently exist (waterproofing all electrical components 
and connectors, additional drip shields, increased drip pan capacities, enhanced cleanliness standards, etc.) 
would need to be incorporated to deal with this new type of water threat Extensive testing of entire systems, 
possibly in a complete airplane, might be necessary and recommended to verify that the added protective 
measures will perform as designed. Reliability requirements for key safety-related components dictate a failure 
rate of less than 1 x 10 9 , and many of the failures postulated following the discharge of water spray could 
jeopardize that reliability, with potentially disasterous results. 

But even the protective measures discussed in this report treat the problem of moisture ingress on a localized 
component level, whereas the water spray hazard must be addressed on a much larger systems scale. The 
Product Safety portion of this report (Section 5.9) discusses the potential for common cause failure, i.e., the 
failure of redundant systems designed to provide an additional margin of safety in the event of component or 
system failure. Very simply, the incorporation of cabin water spray introduces, in an aircrafts present configura- 
tion, a common cause failure source. The remedy for this is straightforward, but costly: components and 
systems in present day aircraft will need to be redesigned and relocated to eliminate water as a common cause 
failure source. 


This study had the luxury of considering only new aircraft and was performed by the aircraft manufacturer 
who sees his products leave the production line as “factory fresh”. While aircraft leave the factory in the as- 
designed configuration, the realities of day-to-day service often result in changes or modifications to the origi- 
nal design, or design intent. The Structures section (Section 5.6) of this report documented and discussed the 
dust and dirt accumulations present after a period of service. These accumulations will tend to entrap moisture 
and allow corrosion to begin at structural junctions which were designed to drain any liquid to the lower lobe 
and out of the aircraft. The Electrical section (Section 5.3) discusses dust contamination of printed circuit card 
connectors, and mineral content present in sprayed water, that may well overcome the safety measures normal- 
ly designed to protect against high humidity, leading to electrical shorts and component loss. 

This does not imply that aircraft are made less safe by their operators, or become less safe after being 
in-service, however, the realities are that drain holes clog, dnp shields are tom or discarded, wire insulation 
gets abraided, etc. These concerns, and others that will surely present themselves, will require careful consider- 
ation before any system that sprays water into an aircraft that experiences diverse operating environments can 
be made safe. 
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Summarizing, our conclusions for this study are as follows: 

• CWS is a safety system that can negatively affect other key safety of flight systems, by creating a 
common cause failure source: 

• Flight and evacuation critical systems will require detail review and potential major redesign to 
mitigate water damage; 

• CWS may increase evacuation time; 

• Evacuation into and prolonged exposure to a cold dimate following dischaige may be hazardous; ( 

• All aircraft systems susceptible to water damage require detail review to minimize damage and 
return to service costs; 

• The cost of returning an aircraft to revenue service following discharge is high; 

• Passenger reactions to activation of water spray are unknown. 

The remarkable safety record enjoyed by commercial jet transportation is a result of high standards of safety 
established by the regulatory bodies, the manufacturers, and the operators over the last 30 years. The incorpo- 
ration of cabin water spray systems, though not without potential benefits, has the potential to compromise a 
hard-earned, and continuously improving, commercial aviation safety record. Any regulation requiring cabin 
water spray systems must be approached cautiously, with open minds to both the potential benefits and, per- 
haps, the more obscure dangers. 
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Appendix A 
Dimension Drawings 
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737-300 General Arrangement 
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747-400 General Arrangement 



213 ft (64.92m) fully fueled 



757-200 General Arrangement 
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767-200 General Arrangement 



213 ft (64.92m) fully fueled 





767-300 General Arrangement 



176 ft 1 in (53.67m) 



777-200 General Arrangement 
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Boeing 737 Standby Power 


With a loss of all generators, the battery is the only 
source of electrical power. The following list 
identifies the busses and significant equipment that 
can be powered from the battery. 

BATTERY BUS 

Land gear lever latch/pressurization warning 
A/C pack valves 
A/C overheat 

Ram air modulation control 
AFDS MCP course 2 - DC 
Passenger address amplifier 
CSD control 
Inverter control 
Transfer bus indication 
Battery bus volts indication 
Captain’s & F/O’s interphone 
APU & engine fire detection 
Master warning & control 
Standby rudder SOV 
Fuel crossfeed valve 
Engine hydraulic SO V 
Clock display 
Aural warning 
Flight recorder 

Anti-skid failure/parking brake 
Anti-skid (outboard) 

Landing gear - air/ground relay 
Standby flood & compass light 
Cockpit dome lights 
Master dim, dimming & test 
Master caution, (A/C, Fuel, Anti-ice) 

Lavatory dome light 
Position light (BATT) 

Standby horizon 

Manual oxy control, oxy indication 
Passenger oxygen 
APU control 
APU fuel boost pump 
Engine master caution 
Engine 1 & wing anti-ice control 
N1 tach indication, eng. 1 , 2 
EGT indication, eng. 1 , 2 


Thrust reverser control, eng. 1 , 2 
Start valves, eng. 1 , 2 
Static inverter 
Fwd airstair cont. - standby 

HOT BATTERY BUS 
Battery overheat 
Standby power manual control 
Battery bus control 
Hot battery bus indication 
Standby power indication 
External power control 
Fire extinguishing bottles 
Fuel SOV eng. 1 , 2 
Clock (timer) 

Entry lights - dim 
Aux. tank fueling valve 

SWITCHED HOT BATTERY BUS 
AFC A & B warning light 
APU & engine generator control 
Fuel SOV indication 
IRS No. 1,2 

Digital analog adapter. No. 1 

11SV-AC STANDBY BUS 
Inverter voltage indication 
Standby bus indication 
Fuel quantity 
Pilots standby lights 
Instrument transformer 1 
Captain’s ADI 

Digital analog adapter, No. 2 
IRS No. 1 

Digital analog adapter/FMC-1 
Engine 1 , 2, right ignition 

PBV-DC STANDBY BUS 
DC manual pressurization control 
VHF comm. No. 1 
DC standby bus indication 
Instrument transformer 
VOR/ILS (captain) 

ADF No. 1 

Stby altimeter/airspeed vibrator 
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Boeing 747-400 Standby Power 


The following list identifies the busses and selected 
equipment receiving power from the respective 
bus. (This equipment can be powered by the 
battery) 

APU BATTERY BUS 
Auxiliary GCU 2 
APU battery overheat protection 
APU DC fuel pump 

APU fire/bleed duct overheat loops A and B 
BCU 2 

Cabin interphone 

EEC 1-4 fire/overheat detection loops A and B 
Engine 1-4 speed sensors 1 and 2 
Engine start air control 
First officer’s interphone 
Left VHF 

Left radio communication panel 
Nacelle anti-ice 1 -4 
Observer's interphone 
Passenger address systems 1 -4 
Primary landing gear display and control 
Service interphone 

APU HOT BATTERY BUS 
APU duct overheat 
APU fire warning horn 
APU inlet door 
APU primary control 
BCU 1 

IRS left, center and right DC 
Left and right outflow valves 


APU STANDBY BUS 

(Captain’s transfer bus unpowered) 

Left FMC 
Left PFD 
Left ND 

MAIN BATTERY BUS 

Auxiliary GCU 1 
APU alternate control 
Autoflight warning 
BCU 1 

E/E cooling smoke override 

Engine 1-4 fuel control valves 

Engine 104 fuel crossfeed valve 

Flight deck dome lights 

Flight deck storm lights 

Flight deck - captain’s indicator lights 

Generator drive disconnect 1 -4 

Hydraulics EDP supply 1 -4 

Left ILS antenna switch 

Left and right manual cabin pressurization\ 

Left aural warning 

Left stabilizer trim/rudder ratio module (DC power) 
Left stick shaker 
Oxygen reset 

Oxygen valve and indication 
Parking brake 

Primary trailing edge flap control DC 
Standby altimeter vibrator 
Standby attitude indicator 
Upper yaw damper 
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Boeing 747-400 Standby Power (Continued) 


MAIN HOT BATTERY BUS 
ACARS DC 
APU fire extinguisher 
APU fuel shutoff valve 
BCU 2 

Emergency evacuation 

Engine 1-4 fire extinguishers A and B 

Engine 1-4 fuel shutoff valve 

Fire switch unlock 

Galley/utility ELCU control bus 1 -4 

GCUs 1-4 

IRS on battery 

Lower cargo fire extinguisher 
Main battery overheat protection 

MAIN STANDBY BUS 
Avionics and warning system status assembly 
Flight control 1 L and 2L AC 
Left ADC 
Left EFIS control 
Left EIU 
Left FMS-CDU 
Left ILS 
Left VOR 

Primary trailing edge flap control AC 
Standby ignition 1 and 2 
Standby ignition engine 3 and 4 
Standby instrument lights 
Upper EICAS 


CAPTAIN'S TRANSFER BUS 
Avionics and warning systems status assembly 
Center EIU 
Left FMC 
Left HF 
Left ND 
Left PFD 

FIRST OFFICER'S TRANSFER BUS 
Lower EICAS 
FMCS autothrottle servo 
Right ADC 
Right EFIS control 
Right EIU 
Right FMC 
Right FMS-CDU 
Right HF 
Right ND 
Right PFD 
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Boeing 757 Standby Power 


The main AC buses provide power for the EICAS 
system. If a single AC bus fails, EICAS automati- 
cally displays a listing of bus equipment that is 
inoperative. When both main AC buses fail, the 
battery is the only source of electrical power. The 
following list identifies the buses and significant 
equipment that can be powered from the battery. 

HOT BATTERY BUS 
Fire extinguisher bottles 
Spar fuel valves 
APU fuel valve 
Clock time references 
IRS emergency power (L & C continuous, 

R for 5 minutes) 

RAT manual deployment 
Landing gear alternate extension 
Fueling system 
Parking brake valve 

BATTERY BUS 
Passenger address system 
Interphone systems 

Engine, APU and cargo fire detection systems 
Fuel crossfeed valve 
Generator controls 
DC fuel pump 

Engine driven hydraulic pump shutoff valves 

Hydraulic PTU control 

Fuel quantity system 

Alternate equipment cooling 

RAT automatic deployment system 

Anti-skid for inboard wheels 

Landing gear air/ground system 

Forward cockpit dome lighting 

Passenger oxygen deployment system 

Standby engine indicating 

Engine start controls 

Engine fuel control valves 

Engine anti-ice 

Right pack valve 

Right engine T/R control 

Wing anti-ice 


STANDBY DC BUS 
Left aural warnign system 
Manual cabin altitude pressure control 
Left yaw damper* 

Left VHF comm, system 
Standby attitude indicator 
Stab trim shutoff valves 
Left stick shaker 
Rudder trim 

Captain’s clock indications 
Left pack valve 
Left engine T/R control 
Bleed air isolation valve* 

STANDBY AC BUS 
Cabin altitude/differential pressure indications 
Left yaw damper* 

Three spoiler pairs 

Left navigation system (VOR, Air Data Computer 
& RDMI) 

Right ADF 
Left ADF** 

Center ILS system 
Standby instrument panel lights 
Engine ignition system 
Wheelwell fire detection 
Main panel flood lights 
Bleed air isolation valve* 

* Requires both ac and dc power to operate 
** As installed 
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Boeing 767 Standby Power 


The main AC buses provide power for the EICAS 
system. If a single AC bus fails, EICAS automati- 
cally displays a listing of bus equipment that is 
inoperative. When both main AC buses fail and the 
Hydraulic Driven Generator fails, the battery is the 
only source of electrical power. The following list 
identifies the buses and significant equipment that 
can be powered from the battery. 

HOT BATTERY BUS 
Fire extinguisher bottles 
Spar fuel valves 
APU fuel valve 
Clock time references 
IRS emergency power (L & C continuous, 

R for 5 minutes) 

RAT manual deployment 
Fueling system 
Parking brake valve 

BATTERY BUS 

Landing gear alternate extension 
Passenger address system 
Interphone systems 

Engine, APU and cargo fire detection systems 
Fuel crossfeed valve 
Generator controls 
DC fuel pump 

Engine driven hydraulic pump shutoff valves 

Air driven hydraulic pump control 

RAT automatic deployment system 

Equipment cooling override system 

Anti-skid for inboard wheels 

Landing gear air/ground system 

Fuel quantity system 

Passenger oxygen deployment system 

Standby engine indication 

Engine start controls 

Engine fuel control valves 

Right engine R-R control 

Right pack valve 

Wing anti-ice 

Right engine anti-ice 

Alternate stabilizer trim 


STANDBY DC BUS 
Engine fuel heat control 
Manual cabin altitude pressure control 
Aisle stand flood light 
Left yaw damper* 

Three spoiler pairs* 

Left VHF comm, system 
Left stick shaker 
Standby attitude indicator 
Stab trim shutoff valves 
Left aural warning speaker 
Left engine T/R control 
Left pack valve 
Left engine anti-ice 
Captains clock indications 
Rudder trim 

STANDBY AC BUS 

Engine ignition system 

Cabin altitude/differential pressure indications 
Left yaw damper* 

Three spoiler pairs* 

Main panel flood lights 

Left navigation system (VOR, Air Data Computer 
& RDMI) 

Right ADF 
Center ILS system 
Wheelwell fire detection 
Duct leak detection 
Equipment cooling standby mode 
Standby instrument panel lights 

* Requires both ac and dc power to operate 
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Chapter 21 —Air-Conditioning 


ATA 

Code 

Subject 


1 

1 

Total 

Cost(s) 

21-00 

Air-conditioning - general 





21-20 

Distribution 

5 

250 

— 

250 

21-21 

Main manifold 

5 

250 

— 

250 

21-22 

Flight deck 





21-23 

Passenger cabin 

8 

400 

— 

400 

21-24 

Individual air distribution 

93 


— 

4,650 

21-25 

Cabin air recirculation 

8 

400 

— 

400 

21-26 

Ventilation 

10 

500 

— 

500 

21-31 

Press control 





21-32 

Press relief valve 





21-33 

Press indication/warning 





21-43 

Forward cargo heat 





21-44 

Aft cargo heat 





21-45 

Supplement heat 





21-51 

Air-conditioning pack 





21-52 

Pack temperature 





21-53 

Ram air 





21-58 

Equipment cooling 

14 

700 

— 

700 

21-61 

Temperature control 





21-64 

Valve position 





21-65 

Cabin temperature 






PRECEDE 5- A'st W ANK NOT FK 


Appendix C-l 


By 


87 










































Chapter 23 — Communications 


ATA 

Code 

Subject 

Time 

(mhr) 

Labor 

Cost(s) 

Material 

Cost(s) 

Total 

Cost(s) 

23-00 

Communication - general 

20 

1,000 

— 

1,000 

23-10 

Speech 





23-12 

Very high frequency (VHF) 
system* 





23-21 

Selective calling (SELCAL)* 





23-22 

ARINC communications 
addressing and reporting system 
(ACARS)* 





23-31 

Passenger address (PA ) system 

10 

500 

— 

500 

23-32 

Passenger entertainment 

1180 

59,000 

80,900 

139,900 

23-41 

Service interphone 





23-42 

Cabin interphone 

5 

250 

— 

250 

23-43 

Ground crew call 





23-51 

Flight interphone 

5 

250 

— 

250 

23-61 

Static discharge 





23-71 

Voice recorder 

6 

300 

— 

300 

23-91 

Airfone system 

4 

200 

— 

200 


* See main equipment center information 
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Chapter 24 —Electrical Power 


ATA 

Code 

Subject 

Time 

(mhr) 

Labor 

Cost(s) 

Material 

Cost(s) 

Total 

Cost(s) 

24-00 

Electrical power 





24-10 

Generator drive 





24-21 

Alternating current (ac) 





24-22 

AC control 





24-23 

Fault sensing 





24-27 

AC annunication 





24-28 

AC meters 





24-31 

Batteries* 





24-32 

Transformer* 





24-33 

Standby power* 





24-34 

Direct current (dc) meters 





24-41 

External power* 





24-51 

1 1 5V-ac distriubtion* 





24-53 

28V-ac distribution* 





24-54 

28V-dc distribution* 






* See main equipment center information 
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Chapter 25 — Equipment/Fumishings 


ATA 

Code 

Subject 

Time 

(mhr) 

Labor 

Cost(s) 

Material 

Cost(s) 

■MM 


Sidewall panel 

224 

11,200 

— 

1 1 ,200 

25-21-04 

Kickstrip (Sw) 

118 

5,900 


7,300 

25-21-05 

Insulation (Sw) 

153 


115,400 

123,050 


Literature pocket 





25-22-02 

Ceiling 

248 


— 

12,400 

25-22-03 

Insulation (ceiling) 

459 

22,950 

20,750 

43,700 

25-23-01 

Passenger service unit (PSU) 

196 

9,800 


9,800 

25-24 



Divider/closet 

81 


— 

4,050 

25-25 

Seat assembly 

1382 

69,100 

36,320 

105,420 

25-27 

Floor covering 

72 

3,600 

4,470 

8,070 

25-28 

Overhead bins 

236 

1 1 ,800 

— 

1 1 ,800 

25-29 

Cabin power 





25-31 

Galley 

172 

8,600 

— 

8,600 

25-41 

Lavatory 

156 

7,800 

— 

7,800 

25-50 

Insulation (CG) 

306 

15,300 

136,100 

151,400 

25-51 

Electrical-cargo compartment 





25-60 

Emergency equipment 





25-61 

Rope-safety 





25-62 

Life vest 

47 



2,350 

25-63 

Miscellaneous emergency 





25-64 

Axe 





25-65 

Escape slide 

12 

600 

— 

600 

25-66 

Escape slide 

12 

600 

— 

600 

25-70 

Electrical equipment center* 





25-71 

Electrical equipment center* 






* See main equipment center information 
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Chapter 33 —Lights 


ATA 

Code 

Subject 

Time 

(mhr) 

Labor 

Cost(s) 

Material 

Cost(s) 

Total 

Cost(s) 

33-10 

Flight compartment lights 





33-11 

Flight compartment illumination 





33-13 

Integral panel 





33-14 

Flight compartment 
miscellaneous 





33-16 

Master dim/test 





33-20 

Cabin lights 





33-21 

Cabin illumination 

248 

12,400 

74,400 

86,800 

33-22 

Passenger loading 

6 

300 

1,800 

2,100 

33-23 

Passenger reading 

62 

3,100 

12,400 

15,500 

33-24 

Passenger signs 

15 

750 

— 

750 

33-25 

Passenger/lavatory call 

15 

750 

JlOfB 

750 

33-26 

Lavatory lights 

5 

250 


1,750 

33-27 

Galley lights 

5 

150 

900 

1,050 

33-31 

Service lights 





33-37 

Cargo lights 





33-41 

Wing lights 





33-42 

Landing/taxi lights 





33-43 

Position lights 





33-44 

Anti-collision 






Exit signs 

6 

300 

1,800 

2,100 

33-51-03 

Floor path lights 

278 

13,900 

4,700 

18,600 

33-51-05 

Aisle lights 

62 



3,100 

33-51-06 

Slide lights 

6 

300 

HEM 

900 

33-51-07 

Battery pack 

2 

100 

— 

100 

33-51-08 

Control panel emergency 

6 

300 

— 

300 

33-51-09 

Flight deck emergecny 
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Chapter 35 — Oxygen 


ATA 

Code 

Subject 

Time 

(mhr) 

Labor 

Cost(s) 

Material 

Cost(s) 

Total 

Cost(s) 

35-11 

Crew oxygen 





35-21 

Passenger oxygen (electric door 
unlatch) 

93 

4,650 

— 

4,650 

35-31 

Portable oxygen 






Chapter 51 —Structures 


ATA 

Code 

Subject 




Total 

Cost(s) 

51-21 

Structure finishes 

48 

2,400 

— 

2,400 

51-24 

Corrosion protection 

36 

1,800 

700 

2,500 

51-31 

Seals 

32 

1,600 

— 

1,600 

51-41 

Airframe drain 

16 

800 

— 

800 

51-51 

Rub pads 





51-61 

Lighting protection 






Chapter 53 —Fuselage 


ATA 

Code 

Subject 



Material 

Cost(s) 

Total 

Cost(s) 

53-01 

Cabin floor 

426 

21,300 

90 

21,390 

53-12 

Nose radome 





53-36 

Forward fairing 





53-66 

Aft fairing 






Stab fairing 





53-87 

Cargo compartment 





53-88 

Cargo panels 

246 

12,300 

— 

12,300 
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Main Equipment Center —El Rack 
M192, WindowH EAT- R 
T102, TRU-R 
T101, TRU-L 
M 1 9 1 , Window H E AT-L 
6.5 mhr x 4 units = 26 mhr 

26 mhr x $50/mhr = $1,300 


Main Equipment Center —E2 Rack 


M00139, 

FCC-L 

M00156, 

ILS-L 

M00148, 

EFIS SYM-GEN-L 

MO0 134, 

FMC-L 

M00100, 

ADC-L 

M00101, 

ADC-R 

M00150, 

EFIS SYM-GEN-R 

M00135, 

FMC-R 

M00158, 

ILS-R 

M00141, 

FCC-R 

MO0 157, 

ILS-C 

M00917, 

ILS-PROC-UNIT 

M00147, 


M00140, 

FCC-C 

M00149, 

EFIS SYM-GEN-C 

M00183, 

TMC 

M00161 , 

IRU-R 

M00160, 

IRU-C 

M00159, 

IRU-L 

6.5 mhr x 

19 units = 123.5 mhr 

123.5 mhr x$50/mhr = $6,175 
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Main Equipment Center —E3 Rack 
K574, Trim Limit SEL-L 
M536, Power Supply 
M530, Spoiler Control 
M528, Rudder Ratio 
M531, Spoiler Control 
M524, Stab trim aileron-L 

M522, Left yaw damper 

M532, Spoiler control 
M537, Power supply 
Ml 68, MCDP 
Ml 24, DME-R 
Ml 01 42, ATC Trans-R 
M10141, ATCTrans-L 
Ml 23, DME-L 
M9124, TCAS 
Ml 38, DFDAU 
Ml 62, Prox SW Elex Unit 
Ml 21, Fuel quantity 
6.5 mhr x 18 units = 117 mhr 

117 mhr x $50/mhr = $5,850 
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Main Equipment Center —E4 Rack 


M00539, 

Power supply 

M00535, 

Spoiler control 

M00523, 

Yaw damper-R 

M00575, 

Relay trim-R 

M00534, 

Spoiler Control 

M00529, 

Rudder ratio-R 

M00533, 

Spoiler control 

M00538, 

Power supply 

Ml 01 82, 

EICAS-R 

P69, 

EICAS replay pnl 

Ml 0181 , 

EICAS-L 

M00132, 

Engine V/B 

M00916, 

Pack flow proc 

M00188, 

VHF-L 

M00180, 

SELCAL decoder 

M00189, 

VHF-R 

M00108, 

Audio ACC unit 

M00177, 

PA amp 

ACARS OAT 

VHF-C 


VHF-COM XCUR-L 

M9117, 

Main mux 

M9116, 

Audio tape reproducer 

6.5 mhr x 25 units = 162.5 mhr 

162.5 mhr x $50/mhr = $8,125 
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Main Equipment Center —E5 Rack 


M00143, 

GCU APU 

M00202, 

XMTR RAD ALTM REC-L 

Ml 0331, 

Flap/Slat ELEX Unit 1 

M00144, 

GCU-L 

M00118, 

Cabin Press Control Auto 1 

M0 1552, 

PDIU-L 

M10610, 

ECC MON-L 

M00203, 

XMTR RAD ALTM REC-R 

Ml 0611, 

ECC MON-R 

Ml 0553, 

PDIU-R 

M00119, 

Cabin Press Control Auto 2 

Ml 0333, 

Flap/Slat ELEX Unit 3 

M00146, 

GRU-R 

M00102, 

Anti-Skid Autobrake 

M00204, 

XMTR RAD ALTM REC-C 

Ml 0332, 

Flap/Slat ELEX Unit 2 

M00116, 

BPCU 

M00115, 

Brk Temp Mon 

6.5 mhr x 18 units = 117 mhr 

117 mhr x $50/mhr = $5,850 
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Main Equipment Center —E6 Rack 


M00187, 

VOR MB-R 


M00186, 

VOR MB-L 


M00215, 

ADF-L 


M216, 

ADF-R 


M00207, 

APU Batt Chgr 


M00127, 

Pack Temp-R 


M00122, 

Hyd Qty 


M00115, 

Brake Temp 


M00102, 

Anti-Skid 


M00206, 

APU Control 


M00195, 

Zont Cont 


M00126, 

Pack Temp-L 


Ml 0389, 

Stby Pack Temp 


Ml 0251, 

Shunt 


M00208, 

APU Batt 


6.5 mhr x 15 units = 

97.5 mhr 

97.5 mhr x $50/mhr = 

$4,875 


Main Equipment Center —Panels 
P31 , P32, P33, P34, P36, P37, P50, P51, P54, P70 
25 mhr/panel includes repair and checkout 

25mhrx10 panels = 250 mhr 

250 mhr x $50/mhr = $12,500 


Appendix C-ll 


97 








ATA 21-20 


ATA 21-21 


ATA 21-23 


ATA 21-24 


ATA 21-25 


ATA 21-26 


ATA 21-58 


A/C DISTRIBUTION 


- Labor 5 mhr 

- Labor Cost (5 x $50) - 

MAIN MANIFOLD 

- Labor 5 mh r 

- Labor Cost (5 x $50) - 

PASS CABIN 

- Labor (6+2) 8 mhr 

- Labor Cost (8 x $50) - 

INDIV AIR DISTR 

- Labor (0.5 mhr x 187) 93 mhr 

- Labor Cost (93 x $50) — 

CABIN AIR RECIR 


- Labor 8 mhr 

- Labor Cost (8 x $50) 

VENTILATION 


- Labor 10 mhr 

- Labor Cost (10 x $50) 

EQUIP COOLING 

- Labor (2x7 mhr) 14 mhr 

- Labor Cost (14 x $50) 
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$ 250 


£444 


$.4650 


$400 


£544 


£144 


98 



ATA 23-00 


C QMffl W C&UPH GE NE R AL 


ATA 23-31 


- Labor (2 x 10 mhr) 20 mhr 

- Labor Cost (20 x $50) 

£ A .SYSTEM 


ATA 23-32 


- Labor (2x5 units) 10 mhr 

- Labor Cost (10 x $50) - 

PASS ENTERTAIN SYS 


- Labor (0.50 x 2360) 1180 mhr 

50% of 

EO 6-57746-3 - Labor Cost (1180 x $50) - 

- Material Cost (0.50 x 161,800) - 


ATA 23-42 


CABIN INTERPHONE 

- Labor (1x5 units) 5 mhr 

- Labor Cost (5 x $50) - 


ATA 23-51 


FLT INTERPHONE 

- Labor (1x5 units) 5 mhr 

- Labor Cost (5 x $50) 


ATA 23-71 


VOICE RECORDER 


ATA 23-91 


- Labor 6 mhr 

- Labor Cost (6 x $50) 

AIRFONE SYS 


- Labor 4 mhr 

- Labor Cost (4 x $50) 


$1000 


£50fl 


$59.000 

$80.900 


$250 




$300 


$ 2 ££ 
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A TA 25-21-Q1 


SIP EW ALLS ( SMi n 


(Remove 


(Repair) 


AX A 2 5- 21 


(Remove & 


(Repair) 


Panel Cost 


Install) - Labor (6x8) + (6x8+4x16) 

48 mhr + 112 mhr - 160 mhr 

Labor Cost (160x$50) - S8.000 

Labor (4x16) - 64 mhr 

Labor Cost (64x$50) - $3 . 200 


zQk 


Install ) 


SIDE W ALL, KICKS TRIP 

Panel Cost 

Carpet Cost 31x $45 

Labor ( Panel )( 2x8 )+( 2x8+6) 
(Carpet) (2x4)+(4x8) 

Labor Cost (78x$50) 

Labor (4x10) 

Labor Cost (40x$50) 


jJLAQQ 

- 38 mhr 

- 40 mhr 

78 mhr 

&L90Q 

- 40 mhr 

- S2.000 
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(411N4107-7) 

( - 9 ) 

(411N4101 -87 ) 

(Remove 6c Install) 


Insulation Blanket Cost 
166 x $215 - $35,700 

$11 

332 x $240 - $79,700 

Labor (8x8)+ (8x8+25) 

64 + 89 - U2. fflhr 

Labor Cost (153x$50) £ 


(Repair) 


Labor (Not Applicable) 


(411N4101 - 7) 
(411N4101- 9) 


$215/EA 

$215/EA 


PER PURCHASING DEPT. 


(Remove & Install) 


Panel Cost 

Labor (8x8+4) + (8x8+4+16) 

69 mhr + 84 mhr 

Labor Cost (152x$50) 

Labor (6x16) - 

Labor Cost (96x$50) ~ 


96 mhr 
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ATA 25- 2 2.t Q3 


(411N4301-2/-3) 

(411N4421-2/-6) 

(Remove & Install) 


(Repair) 


411N4301-2 
411N4301- 3 
411N4421-2 
411N4421-6 


AIA 25-23 


(Remove & Install) 


(Repair) 

ATA Uzl<± 

(Remove & Install) 

(Clean/Dry) 


INSULATION tCEILINGl 

Insulation Blanket Cost 

83 x ( 240+2 30+26 0+2? Q ) 

( 4 ) 

Labor ( 8x8x3 )+( 8x8x3+75) 

192 + 267 - 45 9 a hf 

Labor Cost (459x$50) - 

Labor (Not Applicable) 


$240 

$230 

$260 

$270 


PER PURCHASING DEPT. 


PASSENGER SERVICE UNITS 

PSU Component Cost 

Labor 4x8 + 4x8+8 

32 + 40 - 72 mhr 

Labor Cost (72x$50) - 

Labor (2x62 units) - 124 mhr 

Labor Cost (124 x $50) - 

DIVIDER/CLOSET 

Labor (4x4) + (4x4+3) + 

(2x2) + (2x2+2)- 6} mhr 

Labor Cost (61 x $50) - 

Labor (4x4) + (2x2) - 20 mhr 

Labor Cost (20 x $50) - 
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$20.750 

$ 22 . 95 0 


$ 3 . ,60. 0 . 

$ 6.200 

$3.050 

SI- 000 
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AT A 25 - 25 


SEAT ASSEMBLY 


Seat Cover (Replacement) 

P/N 829948, 829949, 817755, 829625 


(16 x 95.21 + 

171 x 82.26) 

(Remove & Install) 
(Remove & Install) 

(19134001, 19133005 
(20183002, 20132001) - 


Cover Cost 

Labor (8 + 16) 

Labor Cost (24x$50) 

Seats - Labor 
25 + 24 

Labor Cost (49x$50) 
Seat Cushions 


£15.590 

24 mhr 

$ 1.200 

A? m hr 

£ 2.450 


Material 16 (41.30 + 55.55) 

+ 171 (63 + 49.17) 

1549.6 + 19,181 - $20. 730 

(Remove & Install) - Labor 187 (O.Srahr +0.5 mhr) 

- 187 mhr 


Labor Cost (187x$50) - $ 9.350 


Passenger Service System 


(Remove, Install 


(Repair/Checkout ) 


ATA 25-27 


(Mat'l 6e Labor) 
(Remove & Install) 


Labor 187 x 2 mhr •» 374 mhr 

Labor Cost (374x$50) - $18 . 700 


Mech. Seat Operation 

In- seat Passenger Service System Components Repair 
Functional Test of Passenger Service System 
Labor 187 x 4 mhr ** 748 mhr 

Labor Cost (748 x $50) - $37 .400 

FLOOR COVERINGS 
Carpet (Replacement) 

P/N 25- 1994-XXXX 

Panel Cost $ 4.470 

Labor (24+48 mhr) - 72 mhr 

Labor Cost (72x$50) = $ 3 . 600 
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AT A 25-2 8 


OVERHEAD STORAGE UNIT 


(Remove & 
(Repair) 

ATA 25-31 

(Remove & 


(Repair) 

ATA 2 5. r _.4 l 
(Remove & 


(Repair) 


Bin (Door/Housing) Cost 


Install) - Labor (4x16 )+(4xl6+12 ) 

64+76 - 140 mhr 

Labor Cost (140x$50) 

Labor (6x16) - 96 mhr 

Labor Cost (96x$50) 


$ 7.000 
$ 4.800 


GALLEY 

Install) - Labor (FWD) (4x2x3 )+(4x2x3+8 ) 

24 + 32 

«• 36 mhr 

Labor (REAR) ( 3x12 )+( 3x12+20) 

36 + 56 

- 92 mhr 

148 mhr 

Labor Cost (148x$50) * $ 7.400 

Labor (4x6) - 24 mhr 

Labor Cost (24 x $50) «■ $ 1.200 


LAVATORIES 

Install) - Labor (FWD & MID) 

( 2x6x2 )+( 24+8) 

24 + 32 

- 56 mhr 

Labor (REAR) 

( 2x8x2 )+( 2x8x2+12) 

32 + 44 

« 76 mhr 
132 mhr 

Labor Cost (132x$50) “ S 6.600 

Labor (4x6) 24 mhr 

Labor Cost (24 x $50) - S 1.200 
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( 41 1N4851 -82/85/437 ) 



Labor (4 mhr x 3) - 12 mhr 

Labor Cost (12 x $50) 


Labor (4 mhr x 3) 
Labor Cost (12 x $50) 


12 -mhr 


(Remove & Install) 


CABIN ILLUM 
Labor 

1 mhr x (47x4+15x4) - 248 mhr 
Labor Cost (248 x $50) * 
Material Cost (248 units x $300) 


(Remove & Install) 


Labor (1 mhr x 6) - 6 mhr 

Labor Cost (6 x $50) 

Material Cost (6 x $300) 
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(Remove 6* Install) 


- Labor (1 mhr x 187/3) - 62 mhr 


Labor Cost (62 x $50) 
Material Cost (62 x $200) 


(Inspect) 


- Labor (0.25 mhr x 62) - 15 mhr 

- Labor Cost (15 x $50) 


( Inspect) 


- Labor (0.25 mhr x 62) 


- Labor Cost (15 x $50) 


(Remove & Install) 


- Labor (1 mhr x 5) 


- 5 mhr 


- Labor Cost (5 x $50) 

- Material Cost (5 x $300) 


(Remove & Install) 


Labor (1 mhr x 3) 


3_ mhr 


- Labor Cost (3 x $50) 

- Material Cost (3 x $300) 


(Remove & Install) 


Labor (1 mhr x 6) 


- 6 mhr 


- Labor Cost (6 x $50) 

- Material Cost (6 x $300) 
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AIA.3Sr.51 z.Ql 

(EO 6-53336-3) 


ATA 33-51-05 
( Inspect) 


ATA 33 . -?! -06 

(Remove & Install) 


ATA 33-51-07 
( Inspect ) 


ATA 33.-31-08 
( Inspect ) 


ATA 35-21 
( Inspect) 


FLOOR PATH LIGHTS 

- Labor ~ 278 mhr 

- Labor Cost (278 x $50) 

- Material Cost 

AISLE LIGHTS 

- Labor (1 mhr x 187/3) - 62 mhr 

- Labor Cost (62 x $50) 

SLIDE UQHTg 

- Labor (1 mhr x 6) - 6 mhr 

- Labor Cost (6 mhr x $50) 

- Material Cost (6 x $500) 

BATTERY PACK 

- Labor - 2 mhr 

- Labor Cost (2 x $50) 

CONTROL PANEL EMRG 

- Labor - 6 mhr 

- Labor Cost (6 x $50) 

PASS OXYGEN POOR 

- Labor (0.5 mhr x $187) - 93 mhr 

- Labor Cost (93 x $50) 
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$ 4.700 


$ 3.1PQ 


$ 300 

5 m i 


$ 100 


$ 300 


$4.65.0 
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ATA 51-21 


STRUCTURE FINISHES 


( Inspect/Water 

ATA 51-24 
(Application) 


AXA J LL^LL 

( Inspect) 

AIA. -51- 41 
(Inspect ) 


Removal) - Labor (6x8) 

- Labor Cost (48 x $50) 


M mhr 

- $ 2 . 40Q, 


CORROSION PROTECTION 

- Labor (6x6) - 36 fflhr 

- Labor Cost (36 x $50) 

- Material Cost (2x35x10) 


$ L8.QQ 
£ ZIIQ 


SEALS 

- Labor (4x8) * 32 mhr 


- Labor Cost (32 x $50) 

A/ C- JMA1MS 

- Labor (2x8) 

- Labor Cost (16 x $50) 


- S-Ljm 

- 16 mhr 

- $ 800 
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ATA 53-01 


FLOOR PANELS (CABIN) 


(Remove & 


ATA 53-88 


(Remove & 


Panel Cost 

Sealer Cost 18x $5 - £ 2H. 

Wingbox Rest 

Install) - Labor (4x2) + (12x16) + (4x2+2) + (12x16+24) 

8 + 192 + 10 + 216 

* 426 mhr 

Labor Cost (426x$50) - $21.300 

SIDEWALL/FLOOR PANELS (CARGO) 

Panel (Floor) Cost 
Panel (Side) Cost 

Install) - Labor - Floor (4x12) + (4x12+10) 

- 106 mhr 

Sidewall (4x16) + (4x16+12) 

- 140 mhr 
TOTAL 246 mhr 

Labor Cost (246x$50) - $12.300 

MAIN EQUIPMENT CENTER 
El. E2. E3. E4 . E3 . E6 RACKS 


(Remove/Install ) 

Labor 

=* 

0 . 5 mhr 

( Uni t Che ckout ) 

Labor 

- 

3 mhr 

(Sys Checkout) 

Labor 

- 

1 mhr 

(Repair) 

Labor 

** 

2 mhr 


TOTAL 


6 . 5, mhr 
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intentionally BLAN'4 


Subject: 


Configuration Definition of 757-200 Model 761-650 


Configuration Description 

The Model 761-650 is a modified four door 757-200 (Standard 
Option 1.33a) passenger airplane configured to provide a passenger 
cabin water spray system (see reference (b». The nozzle and 
connecting feedline configuration will be a customer variable 
installation. The nozzle arrangement used in this study is for a 
British Airways interior arrangement LOPS-5724-1656 D (see Figure 
6 ). 

The major characteristics of the Model 761-650 (see Figure 1) 
include: 

• Two non-metallic water reservoir tanks (similar to existing 
potable water tanks) of approximately 40 gallons each, in body 
section 43 and 46, respectively. 

• Water tank maintenance panel adjacent each water tank (see 
Figure 4 and 5). 

• 3000 psi nitrogen bottle with squib activated pnuematic valve, 
adjacent each water tank. 

• Water distribution tubing (see figures 2 and 3). 

• Four external fire hose connections through the fuselage lower 
lobe, two forward and two aft of the wing box. 
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• System activation and arming switches at attendant stations 
adjacent no. 1L and no. 4L passenger doors. 

Structural and system definition are presented as changes to the 
reference (a) Basic Airplane: 

Pavloads/Mechanical Systems 

• Add non-metallic water reservoir tank of 43 gallon capacity, 
station 560 to 620, LH outboard of sidewall liner (see figure 
11). Add non-metallic reservoir tank of 40 gallon capacity, 
station 1650 to 1700 adjacent potable water tank (see figure 
10). Tanks are pressurized to 35 psig through nitrogen gas 
charging port. In addition, tanks are to have fill, overflow, 
discharge, and drain ports. 

• Revise cargo sidewall liner to accomodate station 560 reservoir 
tank by extending LH doghouse liner aft to approximately 
station 635. 

• Add 3000 psig nitrogen bottle adjacent each water reservoir 
tank. 

• Add maintenance panel adjacent each water reservoir tank. 
Each panel is to have fill/overflow valve control, drain valve 
control, water tank level indicator, fill port, and 
drain/overflow port. 

• Add four-way valve to fill/overflow lines for each water tank. 
Add drain valve to drain lines of each water tank (1" nom.). 

• Add 15 psi diaphragm valve, electrically actuated shut off 
valve (fail open), and back flow valve for discharge lines of 
each water tank (1" nom.). 

• Add squib activated pnuematic pressure regulating valve and 
pressure relief valve to nitrogen bottle discharge at each water 
tank. Add pressure tubing from nitrogen tanks to each water 
tank nitrogen port. 

• Add external fire hose connection panels at STA 1670, RBL 
and LBL 48 and station 510, RBL and LBL 48. (Four 
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connections total, 1-1/2" nominal.) Quick disconnect type 
coupling with check valve is used. 

• Add 1-1/2" nominal aluminum tube feed lines, tying external 
hose connections to fore and aft header lines (see figure 8). 

Add 1-1/2" nominal aluminum tube hoop lines tying fore and 
aft header lines together, stations 510 and 1630. Add 
frangible couplings, four places, to each hoop line. 

• Add 3/4" nominal aluminum tube fore and aft crown header 
lines, three places, station 297 to 1670. Add 1-1/2" aluminum 
tube fore and aft header line, stations 510 to 830 and 1190 to 
1670, 1" nominal, stations 830 to 1190, LH side below main 
deck. Add manifolds (having integral frangible check valve 
couplings— see figure 12) to header lines, on 10 foot centers. 
Add connecting hoses from manifolds to each nozzle. (See 
Figures 2 and 3.) 

• Add 1” nominal aluminum tube intermediate hoop lines, tying 
fore and aft header lines together, stations 830 and 1190. Add 
frangible check valve couplings, three places, to each hoop 

line. (See figure 7.) 

• Add fill, overflow, and drain hoses, connecting each water tank 
to respective maintenance panels. 

• Water spray nozzles are added to the bull nose of stowage bins 
and overhead panels, per figures 6 and 9. 


Structures 


Body Section 43 

• Support structure for forward tank is added to floor beams at 
station 580 and 620. New structure is to include four vertical 
links, drag links, corresponding machined fittings, floor beam 
intercostals, and web reinforcement. 

• Support structure for nitrogen bottle is added to frames at 
station 600 and 620. 
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• Cutout in lower lobe skin station 580 to 600 LBL 45 with skin 
doubler reinforcement and built up pressure pan and door 
assembly added for water tank maintenance panel. 

• Cutouts in lower lobe skin station 510 RBL and LBL 48 with 
skin doubler reinforcement and built up pressure pan and 
door assembly added for external fire hose connections. 

Body Section 46 

• Support structure for aft tank is added to floor beams at 
station 1661 and 1681.8. New structure to include four 
vertical links, drag links, corresponding machined fittings, 
floor beam intercostals, and web reinforcement. 

• Support structure and intercostals for nitrogen bottle added 
between floor beams at station 1640 and 1661. 

• Cutout in lower lobe skin station 1640 to 1661 LBL 15 with 
skin doubler reinforcement and built up pressure pan and 
door assembly added for water tank maintenance panel. 

• Cutouts in lower lobe skin station 1670 RBL and LBL 48 with 
skin doubler reinforcement and built up pressure pan and 
door assembly added for external fire hose connections. 

Systems 

Flight Deck 


• Add a functional test panel (described in electrical section) to 
flight deck right side panel. 

Electrical 


• Add a guarded switch to the cabin attendant panels adjacent 
doors #1L and #4L, to activate nitrogen tank pneumatic valve 
squibs at forward and aft tanks. Each switch to activate squibs 
at both tanks. 
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• Add an electrical arming switch adjacent each 
activation switch, to control the system solenoid shut 
off valves and to arm the firing circuit. 

• Add arming circuit between arming switches, 

forward and aft solenoid shut off valves, and relay switches in 
forward and aft firing circuits. Solenoid shut off valves are to 
fail open, with power loss. Firing circuit relay switches are to 
fail closed, with power loss. 

• Add firing circuits between cabin activation switch, arming 
circuit relay switch, dedicated battery, and nitrogen bottle 
squib, for forward and aft systems. Forward and aft circuits to 
be cross connected to allow either forward or aft switches to 
activate both forward and aft squibs. Dedicated nickel 
cadmium batteries to be provided for both forward and aft 
circuits, with charging provisions. 

• Add functional test panel to flight deck and each maintenance 
panel to provide check of firing circuit continuity, dedicated 
battery charge, forward and aft tank levels, and nitrogen 
bottle pressures--with pass verification, and failure indication. 

• Safety related electronic boxes, relay panels, and wire 
integration centers to have drip shields added against 
potential water drippage. 


Revision A: Delete arming switch from flight deck. Add arming 

switch adjacent each activation switch. 
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1 Cabin Water Spray System Isometric 

Model 761-650 

2 Schematic Forward Distribution System 

Model 761-650 

3 Schematic Aft Distribution System 

Model 761-650 

4 Schematic Forward Reservoir Tank 

Model 761-650 

5 Schematic Aft Reservoir Tank 
Model 761-650 

6 Nozzle Arrangement 
Model 761-650 

7 Section Sta. 1190 Nozzle & Hoop Line Arr. 
Model 761-650 

8 Section Sta. 1630 - External Hose Connection 
Model 761-650 

9 Section Typical Nozzle Arrangement 
Model 761-650 

1 0 Aft Tank Arrangement 

Model 761-650 

1 1 Fwd Tank Arrangement 

Model 761-650 

1 2 Possible Coupling and Manifold Arrangement 
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CABIN WATER SPRAY SYSTEM ISOMETRIC 

MODEL 761-650 


Figure 1 
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AT ATTENDANT STATION 





















SCHEMATIC FWD DISTRIBUTION SYSTEM 

MODEL 761-650 
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WITH FRANGIBLE COUPLING 
(TYP) 







SCHEMATIC AFT DISTRIBUTION SYSTEM 

MODEL 761-650 


Figure 3 
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SCHEMATIC FWD RESERVOIR TANK 

MODEL 761-650 


Figure 4 
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DRAIN & OVERFLOW PORT 



SCHEMATIC AFT RESERVOIR TANK 

MODEL 761-650 


Figure 5 
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SECTION STA 1630 - EXTERNAL HOSE COMMOTION 
MODEL 761-650 


Figure 8 
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Figure 9 
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THE MANCHESTER, ENGLAND, COMMERCIAL AIRPLANE ACCIDENT 

On August 22, 1985 at 0612 hours a Boeing 737-23 6 with 131 passengers and 6 crew onboard began rollout on 
the active runway at Manchester, England, UK. Thirty-two seconds into the rollout a compressor ejected from 
the No. 2 engine piercing the fuel tank and throwing fuel on the hot engine. The takeoff was immediately 
aborted and the airplane turned off the runway (44-seconds). Although rescue amved very promptly 54 people 
died imme dia tely Subsequently one passenger who was removed from the wreckage 4.5-minutes later sur- 
vived but one rescued 34-minutes later died 6 days later. All of the survivors appear to have exited the airplane 
within 4-minutes of the flight starting (rollout). The first paper reviewed below is a medical analysis of this 
accident followed by a second paper which draws behavioral conclusions from this and other life-threatening 
emergencies. 

“AN ANALYSIS OF FACTORS IMPEDING PASSENGER ESCAPE FROM AIRCRAFT FIRES”, 

I. R. HILL, AVIATION, SPACE AND ENVIRONMENTAL MEDICINE 61:261-265, 1990 

THE MANCHESTER ACCIDENT 

“The early entry of smoke and flames into the cabin caused panic; some people collapsed, others scrambled 
over seats which collapsed. The aisles and exists became blocked; and two passengers refused to leave by the 
left front door. The crew did not use their smoke hoods, and the PA system did not work because it was linked 
to the failed No. 2 engine." 

EVACUATION IN THE MANCHESTER ACCIDENT 

Fifty (50) of the survivors said they had trouble getting out of the airplane: 

• Due to the crush of panicked passengers; 

• Those who were not delayed in escape were seated in first 2 rows or near the right overwing exit; 

• Almost all survivors said they had trouble breathing. 

Incapacitation of people was caused primarily by: 

• Carbon monoxide and cyanide which cause hypoxia (lack of oxygen to tissues of the body) - often 
called narcosis; 


• Heat and toxic particles which cause visual and respiratory tract irritation and behavioral problems. 

CAUSES OF DEATH IN THE MANCHESTER ACCIDENTS 

• 0 - from mechanical trauma; 


• 9 - heat; 

• 4 - CO; 

• 11 - HCN; 

• 10 - CO + HCN; 

• 20 - combination of toxins plus heat. 

Appendix E-l 

133 

PAGF_ffi , , INTENTIONALLY BLANK 


BLANK NOT FILMED 


PRECEDING PAGE 



SOME OF THE AUTHOR’S RECOMMENDATIONS 


• Provide passenger with upper torso restraint; 

• Provide passenger with smoke hoods/masks; 

• Floor level lighting should be installed, etc. 

This analyst made no mention of a water spray system (Hill is from Royal Air Force Institute of Pathology in 
England, UK), and has since stated his reservations regarding water spray systems (Reference 3). 

“HUMAN FACTORS IN CABIN SAFETY", HELEN C. MUIR AND CLAIRE MORRISON, 

CABIN CREW SAFETY/FLIGHT SAFETY FOUNDATION 25(2), MARCH, 1990 

• “In a situation where an immediate threat to life is perceived, rather than all passengers being moti- 
vated to help each other, the main objective that will govern their behavior will be survival for 
themselves, and in some instances, members of their family. In this situation, people do not work 
collaboratively and evacuation can become very disorganized.” 

• “The scientific literature indicates that where there is a serious threat to life, and only a limited 
opportunity for escape, not only is everyone very frightened but it is human nature for individuals 
to compete with each other in order to survive— in the Zeebrugge disaster some adults pulled 
children off life rafts in order to survive.” 


• Staged evacuation drills and some real world accidents are usually orderly. But in most aircraft 
accidents the orderly process was not adhered to, and confusion resulted in blockages in the aisles 
and exits, often with a consequent loss of life; 

- Some passengers do not exit by their nearest exit but travel for considerable distances, i.e., from 
front to back. Why do they choose to do this? 

- Some passengers near exits do not survive. Do they panic, freeze up, give up, get crushed by 
other people, etc.? 

- Blockages have occurred in the aisles and exits in some actual accidents — this does not occur in 
evacuation demonstrations staged for certification 
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